fix: set cookie domain for cross-subdomain authentication

In production, the session cookie needs to be shared across
subdomains (e.g., api.example.com and app.example.com).

- Add cookie_domain property to config (extracts parent domain)
- Set SameSite=None for cross-origin requests in production
- Update auth callback and logout to use cookie domain
- This fixes the login loop where session cookie wasn't sent

apps/api/src/auth/cookies.py

@@ -1,9 +1,10 @@
 from src.config import Settings
 
 
-def build_cookie_options(settings: Settings) -> dict[str, str | bool]:
+def build_cookie_options(settings: Settings) -> dict[str, str | bool | None]:
     return {
         "httponly": True,
         "secure": settings.cookie_secure,
         "samesite": settings.cookie_samesite,
+        "domain": settings.cookie_domain,
     }