feat(templates): name auth cookies per application

[Bccorb]

Cookies are scoped by host and ignore the port, so two Seamless applications served from the same host share one cookie jar and overwrite each other's session. Signing into one signs you out of the other. That is invisible in production, where each application has its own domain, and unavoidable in development, where they are all on localhost.

Both API starters now read AUTH_COOKIE_PREFIX and derive all four cookie names from it, passing them to the auth server and the matching cookieName to requireAuth.

Why the guard has to be told too

requireAuth defaults cookieName independently of the server options:

express/dist/index.js:1375   const { cookieName = "seamless-access", cookieSecret } = opts;

Set a prefix without threading the name through and every request 401s while holding a valid session.

The default is verified byte for byte

Checked against the installed @seamless-auth/express@0.12.0 rather than from memory:

index.js:846  accessCookieName:       opts.accessCookieName       ?? "seamless-access"
index.js:847  registrationCookieName: opts.registrationCookieName ?? "seamless-ephemeral"
index.js:848  refreshCookieName:      opts.refreshCookieName      ?? "seamless-refresh"
index.js:851  preAuthCookieName:      opts.preAuthCookieName      ?? "seamless-ephemeral"

A seamless- prefix reproduces all four exactly, including registration and pre-auth sharing one name, so an existing project upgrades without logging anyone out.

This makes a shipped feature work

seamless-idea-api already writes this variable into every preview stack:

src/preview/compose.ts:81   AUTH_COOKIE_PREFIX: `sidea-${previewId}-`,

Previews publish on 127.0.0.1 with per-preview ports, so they are exactly the case this addresses. Until this lands the variable is set and silently ignored, and two concurrent previews sign each other out.

The same code is already running in seamless-idea-api/src/index.ts. This ports a proven pattern rather than inventing one.

Known gap

Neither template.json sets AUTH_COOKIE_PREFIX, so a project scaffolded by seamless init still gets the default names and still shares a cookie jar with its neighbours. The idea-api path is covered, the CLI path is not. Worth a follow-up to add it to env.set with a per-project value. Flagged in the changeset so it is not lost.

Checks

npm run validate passes. npm run check (typecheck, lint, format:check, test) and npm run build pass in both API starters.