fix(auth): use host-only cookies for IP deployments

Backend/src/lib/Authentication.ts

@@ -70,11 +70,11 @@ export function normalizeUsername(username: string): string {
 }
 
 /** Compute the cookie domain scope from the configured DOMAIN. */
-export function cookieDomain(domain: string): string {
+export function cookieDomain(domain: string): string | undefined {
 	// IP addresses cannot have a registrable parent domain. Treating the first
 	// octet as a subdomain would turn 100.74.255.106 into 74.255.106 and make
 	// browser sessions unusable on direct-IP test/self-hosted deployments.
-	if (domain === "localhost" || /^(?:\d{1,3}\.){3}\d{1,3}$/.test(domain)) return domain;
+	if (domain === "localhost" || /^(?:\d{1,3}\.){3}\d{1,3}$/.test(domain)) return undefined;
 	if (domain.split(".").length > 2) {
 		// Subdomain deployment: scope to the registrable parent domain.
 		return domain.split(".").slice(1).join(".");

Backend/src/routes/api/auth.ts

@@ -16,10 +16,11 @@ import { createLogger } from "../../lib/logger";
 const log = createLogger("auth");
 
 function setSessionCookie(ctr: any, hash: string) {
+	const domain = cookieDomain(DOMAIN);
 	ctr.cookies.set(
 		SESSION_COOKIE,
 		new Cookie(hash, {
-			domain: cookieDomain(DOMAIN),
+			...(domain ? { domain } : {}),
 			httpOnly: true,
 			path: "/",
 			sameSite: "lax",