fix: use hard redirect after login to avoid stale router cache

router.push() can reuse a cached middleware redirect that was
issued before the cookie was set, sending the user back to /login.
window.location.href forces a fresh browser request that carries
the newly set access_token cookie.

Also changed SameSite=Strict -> SameSite=Lax so the cookie is
included in all same-site navigation patterns.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/lib/store.ts

@@ -22,7 +22,7 @@ function persistToken(accessToken: string): void {
   if (typeof window === 'undefined') return;
   localStorage.setItem('access_token', accessToken);
   // 15 min lifetime matches the default JWT_ACCESS_TTL
-  document.cookie = `access_token=${accessToken}; path=/; SameSite=Strict; max-age=900`;
+  document.cookie = `access_token=${accessToken}; path=/; SameSite=Lax; max-age=900`;
 }
 
 export const useAuthStore = create<AuthState>()(