Cookie-first auth data plane

- Stage 1: same-origin requests stop attaching JavaScript-readable Bearer tokens.
- Stage 2: in-memory tokens with a status-only session endpoint.
- Stage 3: server-side session refresh with in-memory Supabase storage.
- CI: authenticated deploy smoke test probes the dashboard and AI layer after each backend deploy.