fix(tests): add url.scheme to FakeRequest; guard request.url access in login

FakeRequest lacked a .url attribute, causing AttributeError on the
_secure = request.url.scheme == "https" line added for dynamic cookie
Secure flag. Added url=SimpleNamespace(scheme="http") to FakeRequest and
used getattr fallback in main.py for any other bare-request call sites.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: gorecodes

backend/arbor/main.py

@@ -259,7 +259,7 @@ async def auth_login(request: Request):
             "step_up_method": session.get("step_up_method", ""),
         },
     )
-    _secure = request.url.scheme == "https"
+    _secure = getattr(getattr(request, "url", None), "scheme", "http") == "https"
     set_session_cookie(response, session["session_id"], secure=_secure)
     set_csrf_cookie(response, generate_csrf_token(), secure=_secure)
     return response

backend/tests/test_phase7_local_auth_foundation.py

@@ -17,11 +17,12 @@
 
 
 class FakeRequest:
-    def __init__(self, body=None, *, cookies=None, headers=None, client_host="127.0.0.1"):
+    def __init__(self, body=None, *, cookies=None, headers=None, client_host="127.0.0.1", scheme="http"):
         self._body = body
         self.cookies = cookies or {}
         self.headers = headers or {}
         self.client = SimpleNamespace(host=client_host)
+        self.url = SimpleNamespace(scheme=scheme)
 
     async def body(self):
         if self._body is None: