Set-Cookie response helper #94

Description

Provide a typed Set-Cookie response helper supporting SameSite, Secure, HttpOnly, Domain, Path and Max-Age. generic response construction builds generic responses and exported core modules exports no cookie helper. Existing repeated-header preservation allows manually built cookies but does not construct or validate them.

Steps to reproduce

1. Inspect core response helpers and exports.
2. Look for a Set-Cookie builder with each requested attribute.
3. Observe that applications currently supply raw header values themselves.

Expected behavior

Handlers build valid Set-Cookie fields and append multiple cookies without replacing earlier fields.

Impact

Applications duplicate attribute formatting and can accidentally mishandle multiple response cookies.

Proposed fix

Add a small portable builder/helper with validated header conversion and documented attribute behavior. Reuse the existing HeaderMap append path and cookie parsing/serialization conventions chosen for the story.

Done when

• All six named attributes can be represented and serialized.
• Invalid cookie/header inputs produce explicit errors.
• Multiple cookies remain separate Set-Cookie values and have focused unit coverage.

Related

Parent story #93; epic #88; tests #95. Merged PR #306 and PR #379 supply response-header preservation only.