fix(auth): configurable SameSite cookie for cross-origin dev setup

Chrome 89+ schemeful same-site treats http://localhost and https://localhost
as different sites, blocking SameSite=Strict cookies on cross-origin fetch
(e.g. Vite on port 5173, API on port 7221).

Fix: make CookieSameSite configurable per environment in JwtSettings.
- Default: Strict (production)
- appsettings.Development.json: None (allows cross-origin cookie in dev)
- When SameSite=None, Secure is always forced (browser requirement)

Revert the earlier Vite proxy approach in favour of this backend config.
VITE_API_BASE_URL remains a freely configurable URL in .env.local.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/.env.example

@@ -1,11 +1,6 @@
 # Base URL of the SlpModularCms .NET API.
-#
-# LOCAL DEV (recommended): leave empty and configure the Vite proxy in
-# vite.config.ts. The proxy forwards /api/* to the backend so all requests
-# stay same-origin — required for the SameSite=Strict refresh-token cookie.
-VITE_API_BASE_URL=
-
-# DIRECT (no proxy): point to the backend URL. CORS must allow this origin
-# with credentials, and SameSite may block the cookie on page reload if the
-# schemes differ (e.g. http frontend → https backend).
-# VITE_API_BASE_URL=https://localhost:7221
+# The backend must be running with CORS configured to allow this origin
+# and to send the httpOnly refresh-token cookie (credentials: include).
+# Set CookieSameSite=None in appsettings.Development.json so the cookie
+# is sent cross-origin when the frontend and backend run on different ports.
+VITE_API_BASE_URL=https://localhost:7221