harden runtime config and docs

etc/uce/settings.cfg

@@ -5,11 +5,15 @@ SESSION_PATH=/var/lib/uce/sessions
 
 # LISTEN ON SOCKETS
 FCGI_SOCKET_PATH=/run/uce/fastcgi.sock
+# FastCGI is normally consumed by the local web server user/group.
+FCGI_SOCKET_MODE=0666
 FCGI_PORT=9993
 
 # HTTP-over-Unix command socket for local CLI/control tooling.
 # Example: curl --unix-socket /run/uce/cli.sock http://localhost/ping
 CLI_SOCKET_PATH=/run/uce/cli.sock
+# Keep the CLI/admin socket private by default; set 0660 only for a trusted group.
+CLI_SOCKET_MODE=0600
 
 # Built-in HTTP/WebSocket listener used for WebSocket Upgrade requests.
 # Keep this behind nginx/Apache on localhost or firewall it from public access.
@@ -34,7 +38,7 @@ WASM_COMPILE_SCRIPT=scripts/compile_wasm_unit
 
 # WASM RUNTIME SETTINGS. Unit execution is always routed through wasm.
 WASM_BACKEND_VERBOSE=0
-WASM_CORE_PATH=/Code/uce.openfu.com/uce/bin/wasm/core.wasm
+WASM_CORE_PATH=bin/wasm/core.wasm
 WASM_MEMORY_LIMIT_BYTES=536870912
 WASM_EPOCH_DEADLINE_TICKS=200
 WASM_EPOCH_PERIOD_MS=50
@@ -85,6 +89,8 @@ ARCHIVE_MAX_ZIP_ENTRIES=4096
 
 # LIFETIME OF SESSION COOKIES IN SECONDS
 SESSION_TIME=2592000
+# Set to 1 behind HTTPS-only frontends to add Secure to session cookies.
+SESSION_COOKIE_SECURE=0
 
 # DEVELOPER-DEFINED ERROR PAGES (see /doc/index.uce?p=error_pages and
 # /doc/index.uce?p=3_blocked_functions). The unit receives the error details in