fix(auth): set SameSite=None for viewer session cookie over HTTPS and update docs

docs/architecture/README.md

@@ -730,7 +730,7 @@ Security is split between edge controls (Cloudflare), reverse proxy controls (ng
 #### Viewer User Accounts
 
 - Register/login/logout via `POST /api/auth/register`, `POST /api/auth/login`, `POST /api/auth/logout`; current session via `GET /api/auth/session`.
-- Passwords are hashed with bcrypt; sessions use a `linearvoid_user_session` cookie with a 30-day default TTL (`USER_SESSION_TTL_HOURS`).
+- Passwords are hashed with bcrypt; sessions use a `linearvoid_user_session` cookie with a 30-day default TTL (`USER_SESSION_TTL_HOURS`). The cookie is `SameSite=None; Secure` over HTTPS (cross-site from the Workers SPA) and `SameSite=Lax` over plain HTTP (local dev).
 - Viewer sign-in UI (username/password) lives in `frontend/index.html`.
 
 #### Rate Limiting and Abuse Controls
@@ -742,7 +742,8 @@ Security is split between edge controls (Cloudflare), reverse proxy controls (ng
 #### CORS and Cross-Origin Behavior
 
 - HLS endpoints exposed by nginx include explicit `Access-Control-Allow-Origin: *` for player compatibility.
-- Admin/authenticated routes are expected to run same-origin behind nginx auth gates.
+- API routes (`/api/*`) include `Access-Control-Allow-Origin` (reflecting an allowlisted origin) and `Access-Control-Allow-Credentials: true` so the Workers-served SPA can call the app origin cross-origin.
+- The viewer session cookie (`linearvoid_user_session`) uses `SameSite=None; Secure` over HTTPS so it is sent cross-site; the admin session cookie remains `SameSite=Strict`.
 
 #### Moderation and Privacy