fix: enable CORS credentials and externalize frontend origin for Sanctum SPA auth

src/.env.example

@@ -4,6 +4,7 @@ APP_KEY=
 APP_DEBUG=true
 APP_TIMEZONE=UTC
 APP_URL=http://localhost
+FRONTEND_URL=http://localhost:3876
 
 APP_LOCALE=en
 APP_FALLBACK_LOCALE=en

src/config/cors.php

@@ -4,13 +4,18 @@
     'paths' => ['api/*', 'sanctum/csrf-cookie'],
     'allowed_methods' => ['*'],
     'allowed_origins' => [
-        'http://localhost:3876',
-        'http://127.0.0.1:5173',
+        env('FRONTEND_URL', 'http://localhost:3876'),
         'https://zigzagdev.github.io',
     ],
     'allowed_origins_patterns' => [],
     'allowed_headers' => ['*'],
     'exposed_headers' => [],
     'max_age' => 0,
-    'supports_credentials' => false,
+
+    // Sanctum's cookie-based SPA auth sends requests with `credentials: 'include'`.
+    // If this is false, the browser will discard the session cookie on cross-origin
+    // responses even though the cookie itself was issued successfully, so the
+    // frontend appears logged in but authenticated requests (e.g. fetching the
+    // current user) fail silently.
+    'supports_credentials' => true,
 ];