feat(be-w3a-115): configure secure cookie storage for session JWTs

[michaelvic123]

Description

Implements secure cookie storage for session JWTs as specified in BE-W3A-115.

Changes

• Added cookie-parser dependency
• Configured CORS with credentials support
• Updated auth routes to set secure HttpOnly cookies for access and refresh tokens
• Updated auth guard to read access token from cookie (with fallback to Authorization header for backward compatibility)
• Updated frontend API client to use credentials: "include"
• Updated logout route to clear cookies

Security

• HttpOnly cookies prevent XSS attacks
• Secure cookies (in production) prevent MITM attacks
• SameSite cookies prevent CSRF attacks
• Backward compatibility maintained with existing Authorization header approach

closes #469

[vercel]

@michaelvic123 is attempting to deploy a commit to the mAzI's projects Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@michaelvic123 Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits