fix(auth): change refresh cookie SameSite Strict→Lax for cross-subdomain fetch

backend/internal/handlers/auth.go

@@ -151,17 +151,13 @@ func (h *AuthHandler) Me(w http.ResponseWriter, r *http.Request) {
 const refreshTokenCookieName = "refresh_token"
 
 func (h *AuthHandler) setRefreshTokenCookie(w http.ResponseWriter, token string) {
-	sameSite := http.SameSiteLaxMode
-	if h.isProd {
-		sameSite = http.SameSiteStrictMode
-	}
 	cookie := &http.Cookie{
 		Name:     refreshTokenCookieName,
 		Value:    token,
 		Path:     "/",
 		HttpOnly: true,
 		Secure:   h.isProd,
-		SameSite: sameSite,
+		SameSite: http.SameSiteLaxMode,
 		MaxAge:   int((30 * 24 * time.Hour).Seconds()),
 	}
 	http.SetCookie(w, cookie)