Hardened authentication with HttpOnly cookies

Reworked platform authentication to use secure, HttpOnly cookie-based sessions, keeping access tokens out of the browser and reducing exposure.

• Access and refresh tokens are stored in secure, HttpOnly cookies instead of browser storage.
• Reduced risk from cross-site scripting (XSS) token theft.
• Origin/CSRF protections applied to cookie-authenticated requests.
• Short-lived access tokens with seamless, automatic refresh.