fix: cross-subdomain SSO auto-login for *arr services

- Set Domain=.sami on session + CSRF cookies so browsers send them to all subdomains
- This fixes Caddy forward_auth returning 401 for radarr/sonarr/prowlarr
- Fix login URL concatenation bug (radarr.samilogin -> radarr.sami/login)
- Fix getSetCookie() missing from _httpsFetch/_httpFetch response objects
- Fix array/string handling for set-cookie header in session-handlers fallback
- Refactor csrf-protection to createCSRFMiddleware() factory with cookieDomain support
- Pass renewCSRFToken through middleware deps chain to TOTP route

dashcaddy-api/routes/auth/index.js

@@ -27,7 +27,8 @@ module.exports = function(ctx) {
     fetchT: ctx.fetchT,
     getServiceById: ctx.getServiceById,
     licenseManager: ctx.licenseManager,
-    servicesStateManager: ctx.servicesStateManager
+    servicesStateManager: ctx.servicesStateManager,
+    renewCSRFToken: ctx.middlewareResult?.renewCSRFToken
   };
 
   const { getAppSession, appSessionCache } = initSessionHandlers(deps);

dashcaddy-api/routes/auth/session-handlers.js

@@ -121,7 +121,7 @@ module.exports = function({ authManager: _authManager, credentialManager: _crede
         return null;
       }
       default:
-        loginUrl = `${baseUrl}login`;
+        loginUrl = `${baseUrl.replace(/\/+$/, '')}/login`;
         loginBody = `username=${formEncode(username)}&password=${formEncode(password)}&rememberMe=on`;
         extraHeaders['Authorization'] = `Basic ${Buffer.from(`${username}:${password}`).toString('base64')}`;
         break;
@@ -168,7 +168,9 @@ module.exports = function({ authManager: _authManager, credentialManager: _crede
 
       const rawCookie = resp.headers.get('set-cookie');
       if (rawCookie) {
-        const cookies = rawCookie.split(/,(?=[^ ])/).map(c => c.split(';')[0].trim()).join('; ');
+        // headers.get('set-cookie') may return an array (Node http) or string
+        const cookieStr = Array.isArray(rawCookie) ? rawCookie.join('; ') : rawCookie;
+        const cookies = cookieStr.split(/,(?=[^ ])/).map(c => c.split(';')[0].trim()).join('; ');
         appSessionCache.set(serviceId, { cookies, exp: Date.now() + SESSION_TTL.COOKIE_SESSION });
         log.info('auth', 'Auto-login successful (fallback), session cached', { serviceId });
         return cookies;

dashcaddy-api/routes/auth/totp.js

@@ -1,5 +1,4 @@
 const express = require('express');
-const { renewCSRFToken } = require('../../csrf-protection');
 const { ValidationError, AuthenticationError } = require('../../errors');
 
 /**
@@ -15,7 +14,7 @@ const { ValidationError, AuthenticationError } = require('../../errors');
  * @param {Object} deps.log - Logger instance
  * @returns {express.Router}
  */
-module.exports = function({ authManager, credentialManager, totpConfig, saveTotpConfig, session, asyncHandler, errorResponse, log }) {
+module.exports = function({ authManager, credentialManager, totpConfig, saveTotpConfig, session, asyncHandler, errorResponse, log, renewCSRFToken }) {
   const router = express.Router();
   
   // Ctx shim for backward compatibility