fix(auth): set SameSite=None for viewer session cookie over HTTPS and update docs

backend/chat/src/auth/auth_test.go

@@ -134,7 +134,7 @@ func TestSetCookie(t *testing.T) {
 	w := httptest.NewRecorder()
 
 	expiresAt := time.Now().Add(1 * time.Hour)
-	SetCookie(w, req, "test_cookie", "abc123", expiresAt)
+	SetCookie(w, req, "test_cookie", "abc123", expiresAt, http.SameSiteStrictMode)
 
 	cookies := w.Result().Cookies()
 	if len(cookies) != 1 {
@@ -165,7 +165,7 @@ func TestClearCookie(t *testing.T) {
 	req := httptest.NewRequest("GET", "/", nil)
 	w := httptest.NewRecorder()
 
-	ClearCookie(w, req, "test_cookie")
+	ClearCookie(w, req, "test_cookie", http.SameSiteStrictMode)
 
 	cookies := w.Result().Cookies()
 	if len(cookies) != 1 {
@@ -183,6 +183,38 @@ func TestClearCookie(t *testing.T) {
 	}
 }
 
+func TestSameSiteForUserCookie(t *testing.T) {
+	req := httptest.NewRequest("GET", "/", nil)
+	req.Header.Set("X-Forwarded-Proto", "https")
+	if got := SameSiteForUserCookie(req); got != http.SameSiteNoneMode {
+		t.Errorf("SameSiteForUserCookie(https) = %v, want None", got)
+	}
+
+	req2 := httptest.NewRequest("GET", "/", nil)
+	if got := SameSiteForUserCookie(req2); got != http.SameSiteLaxMode {
+		t.Errorf("SameSiteForUserCookie(http) = %v, want Lax", got)
+	}
+}
+
+func TestSetCookie_NoneForcesSecure(t *testing.T) {
+	req := httptest.NewRequest("GET", "/", nil)
+	w := httptest.NewRecorder()
+	expiresAt := time.Now().Add(1 * time.Hour)
+	SetCookie(w, req, "test_cookie", "abc123", expiresAt, http.SameSiteNoneMode)
+
+	cookies := w.Result().Cookies()
+	if len(cookies) != 1 {
+		t.Fatalf("expected 1 cookie, got %d", len(cookies))
+	}
+	c := cookies[0]
+	if c.SameSite != http.SameSiteNoneMode {
+		t.Errorf("cookie SameSite = %v, want None", c.SameSite)
+	}
+	if !c.Secure {
+		t.Error("cookie Secure = false, want true (SameSite=None requires Secure)")
+	}
+}
+
 func TestGetTokenFromCookie(t *testing.T) {
 	req := httptest.NewRequest("GET", "/", nil)
 	req.AddCookie(&http.Cookie{Name: "session", Value: "token123"})