fix: enable Sanctum SPA cookie auth for the frontend origin / フロントのオリジンに対するSanctum Cookie認証の有効化

[zigzagdev]

Motivation / 目的

Investigating the reported bug "user mypage does not display after login" found that Sanctum's cookie-based SPA authentication was broken in two independent ways:

1. config/cors.php had supports_credentials: false, so the browser discarded the session cookie on cross-origin responses even though it was issued successfully.
2. Even after fixing that, config/sanctum.php's stateful domain list did not include the frontend's origin (localhost:3876), so Sanctum never routed its requests through session-based auth and fell back to requiring a bearer token — which the frontend never sends (it is fully cookie-based, confirmed in src/app/features/auth/apis/auth-api.ts).

Both had to be fixed together for cookie-based authentication to work end-to-end. See #540 and #542 for the fuller investigation.

Closes #540

What I have done / 実施内容

• Set supports_credentials to true in config/cors.php (with a comment explaining why Sanctum SPA auth requires it)
• Replaced the hardcoded frontend origins in allowed_origins with env('FRONTEND_URL', 'http://localhost:3876')
• Added FRONTEND_URL to .env / .env.example
• Added the FRONTEND_URL host to config/sanctum.php's stateful domains so Sanctum treats the frontend as a stateful (cookie-based) client

Test Results / テスト結果

• Verified via docker exec heritage-app php artisan tinker that config('cors') resolves allowed_origins to ['http://localhost:3876', 'https://zigzagdev.github.io'] with supports_credentials true, and config('sanctum.stateful') includes localhost:3876
• Existing LoginTest / LogoutTest pass with no regressions

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.56%. Comparing base (0ea56e1) to head (1708977).
⚠️ Report is 4 commits behind head on feat/user.

Additional details and impacted files

@@               Coverage Diff               @@
##             feat/user     #546      +/-   ##
===============================================
+ Coverage        62.21%   62.56%   +0.34%     
- Complexity        1604     1620      +16     
===============================================
  Files              135      136       +1     
  Lines             8252     8339      +87     
===============================================
+ Hits              5134     5217      +83     
- Misses            3118     3122       +4     

see 2 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zigzagdev]

ok

[zigzagdev]

ok