fix(auth): pin Supabase auth cookie name to public URL across clients

@supabase/ssr derives the auth cookie storage key from the hostname of the URL
it is given (sb-<sub>-auth-token). After routing server-side clients at the
internal host (kong-prod), the server looked for sb-kong-prod-auth-token while
the browser had set sb-api-auth-token, so server-side getUser() never found the
just-established session and bounced the user off the MFA challenge back to
/login. Pin every client (browser, server, middleware) to the name derived from
NEXT_PUBLIC_SUPABASE_URL via a shared helper so the namespace stays consistent
regardless of which API endpoint the client talks to.

lib/supabase/server.ts

@@ -1,5 +1,6 @@
 import { createServerClient } from '@supabase/ssr';
 import { cookies } from 'next/headers';
+import { supabaseAuthCookieName } from './cookie-name';
 
 export function createSupabaseServerClient() {
   const cookieStore = cookies();
@@ -9,6 +10,9 @@ export function createSupabaseServerClient() {
     process.env.SUPABASE_INTERNAL_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
+      // Pin the cookie name to the public-URL-derived value so it matches the
+      // browser client even though we point the API at the internal host.
+      cookieOptions: { name: supabaseAuthCookieName() },
       cookies: {
         getAll() {
           return cookieStore.getAll();