fix(auth): pin Supabase auth cookie name to public URL across clients

@supabase/ssr derives the auth cookie storage key from the hostname of the URL
it is given (sb-<sub>-auth-token). After routing server-side clients at the
internal host (kong-prod), the server looked for sb-kong-prod-auth-token while
the browser had set sb-api-auth-token, so server-side getUser() never found the
just-established session and bounced the user off the MFA challenge back to
/login. Pin every client (browser, server, middleware) to the name derived from
NEXT_PUBLIC_SUPABASE_URL via a shared helper so the namespace stays consistent
regardless of which API endpoint the client talks to.

middleware.ts

@@ -1,5 +1,6 @@
 import { createServerClient } from '@supabase/ssr';
 import { NextResponse, type NextRequest } from 'next/server';
+import { supabaseAuthCookieName } from '@/lib/supabase/cookie-name';
 
 // Path prefixes that are reachable without a completed MFA step-up. These are
 // the auth flow itself, the MFA enrollment/challenge surface, their supporting
@@ -34,6 +35,9 @@ export async function middleware(request: NextRequest) {
     process.env.SUPABASE_INTERNAL_URL ?? process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY!,
     {
+      // Pin the cookie name to the public-URL-derived value so it matches the
+      // browser client even though the API points at the internal host.
+      cookieOptions: { name: supabaseAuthCookieName() },
       cookies: {
         getAll() {
           return request.cookies.getAll();