fix: include frontend origin in SANCTUM_STATEFUL_DOMAINS / Sanctumのstateful対象にフロントのオリジンを追加

[zigzagdev]

Motivation / 目的

Fixing CORS supports_credentials alone is not enough for the frontend's cookie-based Sanctum auth to work. Sanctum's EnsureFrontendRequestsAreStateful middleware only treats a request as session/cookie-based if its origin is listed in config('sanctum.stateful'). The frontend's localhost:3876 was missing from that list, so requests from it were never routed through the session guard and instead fell back to bearer-token authentication — which the frontend never sends (it is fully cookie-based, confirmed in src/app/features/auth/apis/auth-api.ts). This caused authenticated requests to fail with 401 even after the CORS fix.

CORSの supports_credentials を直すだけでは、Cookieベースのフロントで認証は動きません。SanctumのミドルウェアはリクエストのOriginが config('sanctum.stateful') に載っている場合のみセッション（Cookie）方式で認証し、載っていない場合はBearerトークン方式にフォールバックします。フロントの localhost:3876 がこの一覧に無かったため、CORS修正後も401のままでした。

What I have done / 実施内容

• config/sanctum.php の stateful に、既存の FRONTEND_URL 環境変数からホスト:ポートを導出して追加
• 新しい環境変数は増やさず、CORS修正で導入済みの FRONTEND_URL を再利用

Test Results / テスト結果

• docker exec heritage-app php artisan tinker --execute="print_r(config('sanctum.stateful'));" で localhost:3876 が一覧に含まれることを確認
• 既存の LoginTest / LogoutTest の回帰なしを確認済み

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.21%. Comparing base (6475d3a) to head (7384048).

Additional details and impacted files

@@                   Coverage Diff                   @@
##             fix/cors-credentials     #545   +/-   ##
=======================================================
  Coverage                   62.21%   62.21%           
  Complexity                   1604     1604           
=======================================================
  Files                         135      135           
  Lines                        8252     8252           
=======================================================
  Hits                         5134     5134           
  Misses                       3118     3118           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zigzagdev]

ok