fix(auth): configurable SameSite cookie for cross-origin dev setup

Chrome 89+ schemeful same-site treats http://localhost and https://localhost
as different sites, blocking SameSite=Strict cookies on cross-origin fetch
(e.g. Vite on port 5173, API on port 7221).

Fix: make CookieSameSite configurable per environment in JwtSettings.
- Default: Strict (production)
- appsettings.Development.json: None (allows cross-origin cookie in dev)
- When SameSite=None, Secure is always forced (browser requirement)

Revert the earlier Vite proxy approach in favour of this backend config.
VITE_API_BASE_URL remains a freely configurable URL in .env.local.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -14,17 +14,6 @@ export default defineConfig({
     },
     server: {
         port: 5173,
-        proxy: {
-            // Route all /api calls through the Vite dev server so the browser
-            // sees a single origin. Without this the refreshToken cookie
-            // (SameSite=Strict) is not sent from http://localhost to
-            // https://localhost (different scheme = cross-site in Chrome 89+).
-            '/api': {
-                target: 'https://localhost:7221',
-                changeOrigin: true,
-                secure: false, // allow self-signed dev cert
-            },
-        },
     },
     test: {
         globals: true,