Add SESSION_COOKIE_DOMAIN so /admin SSR sees the session cookie

Production splits web (descrybe.io) and API (api.descrybe.io). The session
cookie was host-only for api.descrybe.io, so the browser never sent it to
the web host. The /admin SvelteKit SSR gate (fetchMeStaff in
+layout.server.ts) forwards the incoming cookie header to /api/auth/me —
with no cookie to forward it always got 401 and bounced every successful
login back to /login?next=/admin (login POST 200, /me 200 from the
browser, /me 401 from the web server).

New SESSION_COOKIE_DOMAIN env (default empty = host-only, local dev
unchanged) sets the session cookie Domain attribute; set it to the parent
domain (descrybe.io) in production so both hosts receive the cookie.
Leading dot is normalized away. CSRF needs no change — it already seeds
cross-origin via the X-CSRF-Token response header.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/api/internal/httpapi/auth_session_integration_test.go

@@ -90,7 +90,7 @@ func TestAuthSessionCoreEndpoints(t *testing.T) {
 		_, _ = pg.Exec(cleanupCtx, `DELETE FROM companies WHERE id = $1`, companyID)
 	})
 
-	sessions := auth.NewSessionManager(pg, "descrybe_session", false, 24)
+	sessions := auth.NewSessionManager(pg, "descrybe_session", "", false, 24)
 	s := &Server{
 		Config: config.Config{
 			CSRFCookieName:      "descrybe_csrf",