refactor: serve static frontend with Go APIs

deploy/ack/go-api.yaml

@@ -45,12 +45,12 @@ spec:
                 secretKeyRef:
                   name: zhinian-go-db
                   key: DATABASE_URL
-            # The session secret must be the same value Next.js uses so the
-            # frontend middleware and the Go backend verify the same cookies.
+            # Go alone creates and verifies the browser session cookie. The
+            # static Web workload must never receive this signing secret.
             - name: ZHINIAN_AUTH_SESSION_SECRET
               valueFrom:
                 secretKeyRef:
-                  name: zhinian-web-auth
+                  name: zhinian-go-auth
                   key: ZHINIAN_AUTH_SESSION_SECRET
             - name: ZHINIAN_BOOTSTRAP_ADMIN_PHONE
               valueFrom: