fix: harden production auth and review flow

- Add environment-aware CORS and secure cookie support:
  * Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
  * Integrate @elysiajs/cors with credentials and origin configuration
  * Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
  * Ensures diagnosis status update and review insert succeed together
  * Rolls back both operations if either fails
  * Preserves behavior: only update if status is needs_review, return badRequest if no row updated

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/index.ts

@@ -1,4 +1,5 @@
 import { Elysia } from 'elysia';
+import cors from '@elysiajs/cors';
 import { env, assertRequiredEnv } from './config/env';
 import { healthRoutes } from './routes/health';
 import { statusRoutes } from './routes/status';
@@ -12,6 +13,10 @@ import { expertRoutes } from './routes/expert';
 assertRequiredEnv();
 
 const app = new Elysia()
+  .use(cors({
+    origin: env.webAppUrl,
+    credentials: true,
+  }))
   .use(healthRoutes)
   .use(statusRoutes)
   .use(authRoutes)