Cookie jar persisted per environment, with a cookie.<name> selector #38

Why

Session-cookie APIs (most web-app backends, CSRF flows, anything behind a login form) cannot be driven today: the http.Client has no jar, and Cookie/Set-Cookie only appear in the redaction lists. Hurl, Bruno and httpyac all keep a jar. It also pairs naturally with apic's persisted session: a login that sets a cookie should work like a login that returns a token.

What

Acceptance criteria:

• Opt-in: cookies: true in apic.yaml or --cookies on the command line. Off by default so existing output and behaviour do not change.
• Cookies are stored per environment in .apic/cookies.json (0600, inside the self-gitignored .apic/, same rules as internal/session/session.go:110-131), keyed by the environment name like captures. Expiry and domain/path rules follow net/http/cookiejar with the public-suffix list left out (document that).
• # @no-cookies on a request sends and stores none. --no-session also ignores the jar.
• New selector cookie.<name> (value of a cookie set by the response) for # @capture and # @assert; cookies in the BDD vocabulary (the response cookie "session" exists).
• apic session lists cookies (names and expiry, values masked); apic session clear clears them with the captures. The UI session tab shows them.
• Redaction already masks Cookie and Set-Cookie; keep that.
• apic test scenarios get an in-memory jar each, shared under --use-session.

Where

internal/runner/runner.go (client construction ~749-792), new internal/session/cookies.go, internal/selector/selector.go, internal/cli/inspect.go (session), internal/ui/panes.go, internal/bdd/steps.go, internal/phrase/builtin.go, internal/project/project.go (config).

Docs

docs/cli.md (flag, config key, files table), docs/format.md (selectors, directive), docs/cheatsheet.md, docs/testing.md (step), docs/comparison.md (cookie row), SECURITY.md (the new file's guarantees).

Tests

Runner test: login sets a cookie, next request sends it, persisted across two Runner instances; per-env isolation; @no-cookies; selector; session clear; BDD scenario.