fix(auth): set session cookie on redirect response

The OAuth callback was setting the session cookie on the 'response'
parameter but returning a brand new RedirectResponse, causing the
cookie to be lost. This created an infinite login loop where the
callback succeeded but /auth/me always returned 401.

- Set cookies on the RedirectResponse instead of the unused response param
- Remove unused 'response: Response' parameter from callback handler
- Fixes login loop in production with cross-domain cookies

apps/api/src/api/auth.py

@@ -59,7 +59,6 @@ async def login(next: str = "/") -> RedirectResponse:
 async def callback(
     code: str,
     state: str,
-    response: Response,
     auth_state: str | None = Cookie(default=None),
     auth_next: str | None = Cookie(default="/"),
     session: AsyncSession = Depends(get_db_session),
@@ -129,7 +128,13 @@ async def callback(
     cookie_secure = bool(cookie_options["secure"])
     cookie_domain = str(cookie_options["domain"]) if cookie_options.get("domain") else None
     
-    response.set_cookie(
+    logger.info("Auth callback complete for user id=%s, redirecting to %s", user.id, auth_next)
+    
+    # Redirect to frontend with the original next path
+    redirect_url = f"{settings.web_base_url}{auth_next}"
+    redirect_response = RedirectResponse(url=redirect_url)
+    
+    redirect_response.set_cookie(
         "session", 
         session_cookie, 
         httponly=True, 
@@ -137,14 +142,10 @@ async def callback(
         secure=cookie_secure,
         domain=cookie_domain,
     )
-    response.delete_cookie("auth_state", samesite="lax", domain=cookie_domain)
+    redirect_response.delete_cookie("auth_state", samesite="lax", domain=cookie_domain)
-    response.delete_cookie("auth_next", samesite="lax", domain=cookie_domain)
+    redirect_response.delete_cookie("auth_next", samesite="lax", domain=cookie_domain)
-
-    logger.info("Auth callback complete for user id=%s, redirecting to %s", user.id, auth_next)
     
-    # Redirect to frontend with the original next path
+    return redirect_response
-    redirect_url = f"{settings.web_base_url}{auth_next}"
-    return RedirectResponse(url=redirect_url)
 
 
 @router.post("/logout")