As a developer I want to read and set cookies in handlers #93

Description

Add portable request-cookie parsing and response Set-Cookie construction. Handlers can already inspect raw header extractor and append raw response headers, but exported core modules and generic response construction offer no cookie parsing/builder abstraction. Raw cookie preservation fixes do not fulfill this story.

Steps to reproduce

1. Inspect core extractors and response helpers.
2. Look for a cookie parser/extractor and typed response-cookie builder.
3. Compare the requested full attribute support with manually supplied header strings.

Expected behavior

A handler reads incoming cookies and sets response cookies with the supported attributes through a portable API.

Impact

Session and consent code repeats parsing, serialization and attribute handling in applications.

Proposed fix

Provide request-cookie parsing/extraction and the Set-Cookie helper in #94 with shared validation and behavior. Preserve distinct Set-Cookie fields and document duplicate/malformed input handling; verify with #95.

Done when

• Incoming Cookie values can be parsed through a handler-facing API.
• Set-Cookie creation supports SameSite, Secure, HttpOnly, Domain, Path and Max-Age.
• Malformed/duplicate input policy and multiple response cookies are documented and tested.

Related

Parent #88; builder #94; unit tests #95. Merged PR #306 and PR #379 preserve raw repeated Set-Cookie values; they do not implement cookie parsing or generation.