Share session cookies across www and app subdomains

Groundwork for moving the app to app.qrmaster.net: the session has to survive the
host change from www.qrmaster.net to app.qrmaster.net.

- Add COOKIE_DOMAIN and apply it to the auth, CSRF, attribution and OAuth flow
  cookies. Honoured only in production, because browsers reject dotted domains on
  localhost - a prod .env copied into a dev environment would otherwise break
  every login instead of just ignoring the value.
- Expire both the host-only and the domain-scoped variant on logout. Next's
  ResponseCookies is keyed by cookie name and rewrites the entire set-cookie
  header from its internal map on every set(), so the two variants must be
  appended manually - otherwise one overwrites the other and the surviving stale
  cookie keeps the user signed in.
- Pass COOKIE_DOMAIN as both build arg and runtime env: process.env is inlined
  into the Edge middleware bundle, so a runtime-only value would leave the
  middleware and the route handlers disagreeing about the cookie scope.

No behaviour change while COOKIE_DOMAIN is unset.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

env.example

@@ -16,6 +16,11 @@ DATABASE_URL=postgresql://postgres:postgres@db:5432/qrmaster?schema=public
 NEXTAUTH_URL=http://localhost:3050
 NEXTAUTH_SECRET=your-secret-key-here-change-in-production
 
+# Session cookie scope. Leave EMPTY for local development (browsers reject dotted
+# domains on localhost). In production set to `.qrmaster.net` so the session is shared
+# between www.qrmaster.net and app.qrmaster.net. Only honoured when NODE_ENV=production.
+COOKIE_DOMAIN=
+
 # OAuth Providers (Optional)
 GOOGLE_CLIENT_ID=
 GOOGLE_CLIENT_SECRET=