chore(deps,middleware): bump cookie to 2.0.1 and migrate to parseCookie

[Weegy]

Split out of the consolidated batch #658, because this is not a version bump — it needs a source change, and it touches the session-verification path.

Supersedes #652.

Why it could not ride along in the batch

cookie v2.0.0 made two breaking changes:

1. Removed the deprecated parse / serialize exports. They were renamed in
   v1.1.0 (parse → parseCookie, serialize → stringifySetCookie) with the old
   names kept as aliases, and v2.0.0 dropped the aliases.
2. ESM-only. Node 22+ can require(esm); older Node is unsupported.

We import exactly the removed symbol:

// middleware/src/auth/operatorAuthAccessor.ts
import { parse as parseCookieHeader } from 'cookie';

So #652 as raised does not compile.

The ESM half is a non-issue here: middleware is already "type": "module", and
the whole stack is pinned to Node 22 (engines ">=22.13.0 <23", .nvmrc
22.22.3, CI node-version: '22', Dockerfiles on node:22.23.2).

The change

cookie ^0.7.2 → ^2.0.1, plus the one-line rename at the single call site:

-import { parse as parseCookieHeader } from 'cookie';
+import { parseCookie as parseCookieHeader } from 'cookie';

parseCookie returns Cookies = Record<string, string | undefined>, which is
exactly the type the call site already declares for the result, so nothing else
in the function changes.

@types/cookie is dropped. cookie v2 ships its own dist/index.d.ts
alongside its export target, so TypeScript resolves types from the package itself
and the @types/cookie stub is never consulted. Nothing else in the tree depends
on it (verified against the lockfile) — leaving it would keep a types package
describing an API we no longer use.

Blast radius

One import, one function, in the operator-session path — createOperatorAuthAccessor
is the thin adapter from a raw Cookie header to evaluateSessionToken, which is
the single code path deciding session validity for gated /api/v1/* routes and for
plugins using ctx.operatorAuth.

express and cookie-parser are unaffected: they declare cookie@^0.7.1 and
cookie@0.7.2 respectively, so npm nests their own 0.7.2 copies. Only our direct
import resolves to 2.0.1. The lockfile diff shows exactly that — 27 added / 5
removed lines, with node_modules/cookie at 2.0.1 and
node_modules/express/node_modules/cookie plus
node_modules/cookie-parser/node_modules/cookie at 0.7.2.

Verification

Run locally on Node 22.22.3 in CI job order (npm ci → build → lint → typecheck
→ test). Results are in the PR checks; the suites that exercise this accessor are
test/channelApi/adminKeysRouter.test.ts,
test/channelApi/publicPathsExemption.test.ts and
test/publicMcp/publicMcpKeyBindingsAdmin.test.ts.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}