fix: set cookie domain for cross-subdomain authentication

In production, the session cookie needs to be shared across
subdomains (e.g., api.example.com and app.example.com).

- Add cookie_domain property to config (extracts parent domain)
- Set SameSite=None for cross-origin requests in production
- Update auth callback and logout to use cookie domain
- This fixes the login loop where session cookie wasn't sent

apps/api/src/config.py

@@ -117,6 +117,22 @@ class Settings(BaseSettings):
     @property
     def cookie_samesite(self) -> str:
         if self.app_env == "production":
-            return "strict"
+            return "none"
 
         return "lax"
+
+    @property
+    def cookie_domain(self) -> str | None:
+        """Return the parent domain for cross-subdomain cookies.
+
+        E.g., api.example.com and app.example.com both share .example.com
+        """
+        if self.app_env != "production":
+            return None
+
+        # Extract parent domain from api_domain
+        # e.g., "api.headquarter.commumedia.org" -> ".headquarter.commumedia.org"
+        parts = self.api_domain.split(".")
+        if len(parts) >= 3:
+            return "." + ".".join(parts[1:])
+        return None