fix: harden production auth and review flow

- Add environment-aware CORS and secure cookie support:
  * Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
  * Integrate @elysiajs/cors with credentials and origin configuration
  * Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
  * Ensures diagnosis status update and review insert succeed together
  * Rolls back both operations if either fails
  * Preserves behavior: only update if status is needs_review, return badRequest if no row updated

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/config/env.ts

@@ -7,6 +7,9 @@ const googleOAuthEnabled = Boolean(
   Bun.env.GOOGLE_CLIENT_ID && Bun.env.GOOGLE_CLIENT_SECRET && Bun.env.GOOGLE_REDIRECT_URI,
 );
 
+const webAppUrl = Bun.env.WEB_APP_URL ?? 'http://localhost:5173';
+const secureCookies = Bun.env.SECURE_COOKIES === 'true' || webAppUrl.startsWith('https://');
+
 export const env = {
   port: Number(Bun.env.API_PORT ?? 3000),
   databaseUrl: Bun.env.DATABASE_URL,
@@ -18,7 +21,8 @@ export const env = {
   googleClientId: Bun.env.GOOGLE_CLIENT_ID,
   googleClientSecret: Bun.env.GOOGLE_CLIENT_SECRET,
   googleRedirectUri: Bun.env.GOOGLE_REDIRECT_URI,
-  webAppUrl: Bun.env.WEB_APP_URL ?? 'http://localhost:5173',
+  webAppUrl,
+  secureCookies,
 };
 
 export function assertRequiredEnv() {