fix: cross-subdomain SSO auto-login for *arr services

- Set Domain=.sami on session + CSRF cookies so browsers send them to all subdomains
- This fixes Caddy forward_auth returning 401 for radarr/sonarr/prowlarr
- Fix login URL concatenation bug (radarr.samilogin -> radarr.sami/login)
- Fix getSetCookie() missing from _httpsFetch/_httpFetch response objects
- Fix array/string handling for set-cookie header in session-handlers fallback
- Refactor csrf-protection to createCSRFMiddleware() factory with cookieDomain support
- Pass renewCSRFToken through middleware deps chain to TOTP route

dashcaddy-api/src/utils/http.js

@@ -86,7 +86,13 @@ function _httpsFetch(url, opts = {}, timeoutMs = TIMEOUTS.HTTP_DEFAULT) {
           statusText: res.statusMessage,
           json: () => Promise.resolve(JSON.parse(data)),
           text: () => Promise.resolve(data),
-          headers: { get: (k) => res.headers[k.toLowerCase()] },
+          headers: {
+            get: (k) => res.headers[k.toLowerCase()],
+            getSetCookie: () => {
+              const sc = res.headers['set-cookie'];
+              return sc ? (Array.isArray(sc) ? sc : [sc]) : [];
+            }
+          },
         });
       });
     });
@@ -142,7 +148,13 @@ function _httpFetch(url, opts = {}, timeoutMs = TIMEOUTS.HTTP_DEFAULT) {
           statusText: res.statusMessage,
           json: () => Promise.resolve(JSON.parse(data)),
           text: () => Promise.resolve(data),
-          headers: { get: (k) => res.headers[k.toLowerCase()] },
+          headers: {
+            get: (k) => res.headers[k.toLowerCase()],
+            getSetCookie: () => {
+              const sc = res.headers['set-cookie'];
+              return sc ? (Array.isArray(sc) ? sc : [sc]) : [];
+            }
+          },
         });
       });
     });