fix(auth): point to api.saplinglearn.com and share cookie across subdomains

Updates wrangler.toml [vars] to api.saplinglearn.com so frontend and
backend share saplinglearn.com as the registrable domain. Adds a
COOKIE_DOMAIN env var so the session cookie can be set with
domain=.saplinglearn.com in production, letting the browser send it to
api.saplinglearn.com on cross-origin fetches. Reverts SameSite back to
lax since the request is now same-site.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: AndresL230

frontend/src/app/api/auth/session/route.ts

@@ -2,6 +2,7 @@ import { NextRequest, NextResponse } from 'next/server';
 import { signSession, SESSION_MAX_AGE } from '@/lib/sessionToken';
 
 const SESSION_SECRET = process.env.SESSION_SECRET;
+const COOKIE_DOMAIN = process.env.COOKIE_DOMAIN || undefined;
 
 async function verifyAuthToken(token: string): Promise<string | null> {
   if (!SESSION_SECRET) return null;
@@ -71,10 +72,11 @@ export async function POST(request: NextRequest) {
     const response = NextResponse.json({ ok: true });
     response.cookies.set('sapling_session', token, {
       httpOnly: true,
-      sameSite: 'none',
+      sameSite: 'lax',
       secure: true,
       path: '/',
       maxAge: SESSION_MAX_AGE,
+      ...(COOKIE_DOMAIN ? { domain: COOKIE_DOMAIN } : {}),
     });
     return response;
   } catch {
@@ -86,10 +88,11 @@ export async function DELETE() {
   const response = NextResponse.json({ ok: true });
   response.cookies.set('sapling_session', '', {
     httpOnly: true,
-    sameSite: 'none',
+    sameSite: 'lax',
     secure: true,
     path: '/',
     maxAge: 0,
+    ...(COOKIE_DOMAIN ? { domain: COOKIE_DOMAIN } : {}),
   });
   return response;
 }

frontend/wrangler.toml

@@ -14,8 +14,8 @@ binding = "ASSETS"
 directory = ".open-next/assets"
 
 [vars]
-NEXT_PUBLIC_API_URL = "https://sapling-production-cb12.up.railway.app"
-BACKEND_URL = "https://sapling-production-cb12.up.railway.app"
+NEXT_PUBLIC_API_URL = "https://api.saplinglearn.com"
+BACKEND_URL = "https://api.saplinglearn.com"
 
 [observability]
 enabled = true