Fix #118 - toResponse overwrites multiple Set-Cookie headers

[rastislavcore]

Summary

When building a Response, toResponse() merged headers with headers.set(key, value). For repeated header names, Headers#set() overwrites the previous value, so only one Set-Cookie was kept. Endpoints that set several cookies (e.g. session token, session_data, dont_remember) only sent one cookie to the client, so the session cookie was often dropped and the user did not appear logged in.

This change uses headers.append(key, value) for the set-cookie header when copying/merging headers, so every Set-Cookie line is preserved in the final response.

Changes

• src/to-response.ts: When copying headers (Response branch and all three merge points in the _flag=json branch), use append for set-cookie and set for other headers.
• src/to-response.test.ts: New describe block "Set-Cookie header preservation" with three tests:
  • Multiple Set-Cookie when merging onto an existing Response
  • Multiple Set-Cookie in _flag=json with init.headers
  • Multiple Set-Cookie from routerResponse.headers in _flag=json

Testing

• npm test in the package: to-response.test.ts passes (32 tests including the 3 new ones).

Closes #118.