fix: harden production auth and review flow

- Add environment-aware CORS and secure cookie support:
  * Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
  * Integrate @elysiajs/cors with credentials and origin configuration
  * Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
  * Ensures diagnosis status update and review insert succeed together
  * Rolls back both operations if either fails
  * Preserves behavior: only update if status is needs_review, return badRequest if no row updated

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/api/src/lib/auth.ts

@@ -30,11 +30,13 @@ function hashToken(token: string) {
 
 export function createSessionCookie(token: string) {
   const maxAge = 60 * 60 * 24 * 30;
-  return `${sessionCookieName}=${token}; HttpOnly; Path=/; SameSite=Lax; Max-Age=${maxAge}`;
+  const sameSite = env.secureCookies ? 'SameSite=None; Secure' : 'SameSite=Lax';
+  return `${sessionCookieName}=${token}; HttpOnly; Path=/; ${sameSite}; Max-Age=${maxAge}`;
 }
 
 export function clearSessionCookie() {
-  return `${sessionCookieName}=; HttpOnly; Path=/; SameSite=Lax; Max-Age=0`;
+  const sameSite = env.secureCookies ? 'SameSite=None; Secure' : 'SameSite=Lax';
+  return `${sessionCookieName}=; HttpOnly; Path=/; ${sameSite}; Max-Age=0`;
 }
 
 export function readSessionToken(cookieHeader: string | null | undefined) {