security: migrate auth tokens to httpOnly cookies (hybrid bearer token approach)

Backend:
- CookieBearerToken middleware reads httpOnly cookie and injects Authorization
  header before Sanctum validates (prepended to API middleware group)
- SetAuthCookie trait provides cookie creation/expiry helpers with per-app
  cookie names (crewli_admin_token, crewli_app_token, crewli_portal_token)
- LoginController sets token via Set-Cookie, removes it from JSON body
- LogoutController expires the auth cookie on logout
- AuthRefreshController (POST /auth/refresh) rotates tokens with new cookie
- InvitationController accept also sets token via cookie, not JSON body
- All cookies: httpOnly, SameSite=Strict, Secure (in production)

Frontend (all three SPAs):
- Removed all localStorage token storage (apps/app, apps/portal)
- Removed all JS-readable cookie token storage (apps/admin)
- Removed Authorization: Bearer header interceptors from axios
- Auth stores now rely on GET /auth/me to validate httpOnly cookie
- Admin app: new Pinia auth store replaces useCookie-based auth pattern
- withCredentials: true ensures browser sends cookies automatically

Fixes security findings A13-1 (localStorage tokens) and A13-2 (admin
cookie flags). Tokens are now invisible to JavaScript.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

api/app/Http/Controllers/Api/V1/Traits/SetAuthCookie.php

@@ -0,0 +1,87 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Http\Controllers\Api\V1\Traits;
+
+use Illuminate\Http\Request;
+use Symfony\Component\HttpFoundation\Cookie;
+
+trait SetAuthCookie
+{
+    private const COOKIE_MAP = [
+        'admin' => 'crewli_admin_token',
+        'app' => 'crewli_app_token',
+        'portal' => 'crewli_portal_token',
+    ];
+
+    private const COOKIE_TTL_MINUTES = 60 * 24 * 7; // 7 days
+
+    protected function resolveCookieName(Request $request): string
+    {
+        $origin = $request->headers->get('Origin')
+            ?? $request->headers->get('Referer')
+            ?? '';
+
+        $adminUrl = config('app.frontend_admin_url', 'http://localhost:5173');
+        $appUrl = config('app.frontend_app_url', 'http://localhost:5174');
+        $portalUrl = config('app.frontend_portal_url', 'http://localhost:5175');
+
+        if ($this->originMatches($origin, $adminUrl)) {
+            return self::COOKIE_MAP['admin'];
+        }
+
+        if ($this->originMatches($origin, $appUrl)) {
+            return self::COOKIE_MAP['app'];
+        }
+
+        if ($this->originMatches($origin, $portalUrl)) {
+            return self::COOKIE_MAP['portal'];
+        }
+
+        return self::COOKIE_MAP['app'];
+    }
+
+    protected function makeAuthCookie(string $cookieName, string $token): Cookie
+    {
+        return new Cookie(
+            name: $cookieName,
+            value: $token,
+            expire: now()->addMinutes(self::COOKIE_TTL_MINUTES),
+            path: '/',
+            domain: config('session.domain'),
+            secure: config('app.env') === 'production',
+            httpOnly: true,
+            sameSite: 'Strict',
+        );
+    }
+
+    protected function forgetAuthCookie(string $cookieName): Cookie
+    {
+        return new Cookie(
+            name: $cookieName,
+            value: '',
+            expire: now()->subMinute(),
+            path: '/',
+            domain: config('session.domain'),
+            secure: config('app.env') === 'production',
+            httpOnly: true,
+            sameSite: 'Strict',
+        );
+    }
+
+    private function originMatches(string $origin, string $configuredUrl): bool
+    {
+        if ($origin === '' || $configuredUrl === '') {
+            return false;
+        }
+
+        // Parse to compare host+port, ignoring trailing slashes and paths
+        $originHost = parse_url($origin, PHP_URL_HOST);
+        $originPort = parse_url($origin, PHP_URL_PORT);
+        $configHost = parse_url($configuredUrl, PHP_URL_HOST);
+        $configPort = parse_url($configuredUrl, PHP_URL_PORT);
+
+        return $originHost === $configHost && $originPort === $configPort;
+    }
+}