fix: do not crash auth cookies if is_production is missing

app/routes/auth.py

@@ -266,16 +266,31 @@ def _auth_redirect_for_user(user: User, next_path: str) -> RedirectResponse:
     return response
 
 
-def _set_media_auth_cookie(response: Response, token: str, expires_in: int) -> None:
+def _is_production_environment(settings: object | None = None) -> bool:
+    """Resolve production safely even if an older Settings build lacks is_production."""
+    active = settings or get_settings()
+    flag = getattr(active, "is_production", None)
+    if isinstance(flag, bool):
+        return flag
+    return str(getattr(active, "environment", "") or "").strip().casefold() == "production"
+
+
+def _set_media_auth_cookie(
+    response: Response,
+    token: str,
+    expires_in: int,
+    *,
+    settings: object | None = None,
+) -> None:
     """Allow browser media elements to authenticate without exposing a bearer token."""
-    settings = get_settings()
+    production = _is_production_environment(settings)
     response.set_cookie(
         key=MEDIA_AUTH_COOKIE,
         value=token,
         max_age=expires_in,
         httponly=True,
-        secure=settings.is_production,
-        samesite="none" if settings.is_production else "lax",
+        secure=production,
+        samesite="none" if production else "lax",
         path="/generated",
     )