Android WebView blocks third-party cookies by default. This patch:
- Returns session token in login/register response body
- Stores token in localStorage, sends via Authorization: Bearer header
- Backend getCurrentUser supports Authorization header fallback
Co-Authored-By: Claude <noreply@anthropic.com>
- Cookie SameSite now dynamic: None;Secure when behind HTTPS proxy, Lax otherwise
- AuthGuard useEffect no longer overwrites Zustand store with null from background refetch
- AuthInitializer: add staleTime 30s
Co-Authored-By: Claude <noreply@anthropic.com>
- Add environment-aware CORS and secure cookie support:
* Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
* Integrate @elysiajs/cors with credentials and origin configuration
* Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
* Ensures diagnosis status update and review insert succeed together
* Rolls back both operations if either fails
* Preserves behavior: only update if status is needs_review, return badRequest if no row updated
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
