Fix cross-subdomain cookie for iOS Safari

Change SameSite from Lax to None to allow cookie to be sent
when navigating between L1 and L2 subdomains. iOS Safari's
Intelligent Tracking Prevention may block Lax cookies.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

server.py

@@ -417,7 +417,7 @@ async def ui_login_submit(request: Request):
         value=token.access_token,
         httponly=True,
         max_age=60 * 60 * 24 * 30,  # 30 days
-        samesite="lax",
+        samesite="none",
         domain=COOKIE_DOMAIN,  # Share across subdomains
         secure=True  # Required for cross-subdomain cookies
     )
@@ -503,7 +503,7 @@ async def ui_register_submit(request: Request):
         value=token.access_token,
         httponly=True,
         max_age=60 * 60 * 24 * 30,  # 30 days
-        samesite="lax",
+        samesite="none",
         domain=COOKIE_DOMAIN,  # Share across subdomains
         secure=True  # Required for cross-subdomain cookies
     )