Fix session persistence across page navigation

[fishcharlie]

Summary

• scope browser session cookies to the full application so server-rendered refreshes and live-program navigation remain authenticated
• expire the legacy API-only cookie during sign-in and clear both scopes during logout
• add regression coverage for document-wide scope and legacy-cookie migration

Testing

• node --import tsx --test tests/auth.test.ts
• pnpm typecheck
• pnpm --filter @signalhaven/backend lint (passes with three pre-existing logger warnings)
• pnpm exec prettier --check apps/backend/src/auth/middleware.ts apps/backend/tests/auth.test.ts

AI disclosure: This pull request was generated using Codex on behalf of @rrainn.