Android WebView blocks third-party cookies by default. This patch: - Returns session token in login/register response body - Stores token in localStorage, sends via Authorization: Bearer header - Backend getCurrentUser supports Authorization header fallback Co-Authored-By: Claude <noreply@anthropic.com>