How the cookie is protected. 'encrypt' (default) hides the payload with
AES-256-GCM; 'sign' leaves it readable base64url JSON under an
HMAC-SHA256 signature, which suits the store strategy where the cookie
holds only an opaque id.
Usage
import { type SessionPluginOptions } from "session-plugin/src/index.ts";