Fix config namespace in the security cookie route

[sadiqk2]

CreateSecurityCookieController reads config('native-php.secret'), but there is no native-php config namespace — the package ships config/nativephp.php and config/nativephp-internal.php, and grep finds native-php nowhere else in the repo.

So today:

abort_if($request->input('secret') !== config('native-php.secret'), 403);

resolves to abort_if($request->input('secret') !== null, 403). The guard passes only when no secret parameter is supplied, and then the cookie is issued with a null value:

value: config('native-php.secret'),   // null

The middleware that consumes it compares against config('nativephp-internal.secret'), so the cookie this route sets can never satisfy it.

This is also the one route PreventRegularBrowserAccess deliberately exempts:

if ($request->path() === '_native/api/cookie') {
    return $next($request);
}

which seems worth having work as intended.

The fix points both reads at nativephp-internal.secret, matching the middleware and config/nativephp-internal.php.

Noticed while reading the request-authentication path closely — I was tracing how the cookie and the X-NativePHP-Secret header relate. Happy to adjust if the intent was different, or to close this if the route is vestigial now that the runtime sets _php_native directly in the Electron session via appendCookie().

[gwleuverink]

Confirmed this locally. config('native-php.secret') is null, so the guard only passes when no secret is sent at all, and the cookie it then sets is null, which the middleware can never match.

It does break CreateSecurityCookieControllerTest. That test sets native-php.secret and expects a 403 that only happens because of the bug, so it goes red. It needs pointing at nativephp-internal.secret with the secret actually passed.

Before fixing it though, is the route still doing anything? Nothing calls it at runtime. Electron sets _php_native itself and puts the secret header on every request. I'd rather delete the route, controller, test and the middleware exemption. If we keep it, it should 403 on a null secret instead of issuing an empty cookie.