Forward COOKIE_DOMAIN to the app container in docker-compose

Without it, the subdomain deployment (app.<domain>/admin.<domain>
sharing a login with the bare domain) would silently get host-only
cookies since the value never reached the container's environment.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -82,6 +82,11 @@ services:
       # this URL and keep DATABASE_URL (the owner) for migrations/schema init.
       - APP_DATABASE_URL=postgresql://receipt_app:${APP_DATABASE_PASSWORD:-receipt_app_secure_password}@postgres:5432/${POSTGRES_DB:-receipt_scanner}
       - NEXT_PUBLIC_APP_URL=${NEXT_PUBLIC_APP_URL:-http://localhost:3000}
+      # Scopes session/CSRF/guest/OAuth cookies to the parent domain so
+      # app.<domain> and admin.<domain> share the same login as the bare
+      # domain (see src/lib/auth/config.ts). Leave unset for host-only
+      # cookies (single-domain / local development).
+      - COOKIE_DOMAIN=${COOKIE_DOMAIN:-}
       - NEXT_PUBLIC_UMAMI_SRC=${NEXT_PUBLIC_UMAMI_SRC:-}
       - NEXT_PUBLIC_UMAMI_ID=${NEXT_PUBLIC_UMAMI_ID:-}
       - OPENROUTER_API_KEY=${OPENROUTER_API_KEY}