Cross-origin customer auth for headless integrations

storefront.auth.* (login, isLoggedIn(), the Customer Console) now works from a headless integration hosted on its own domain, not just one proxied under the shop’s — the session cookie is now SameSite=None; Secure in production. This closed two CORS/CSRF gaps that relaxing SameSite would otherwise have reopened; see Authentication and this repo’s CLAUDE.md for the full writeup.