fix: use hard redirect after login to avoid stale router cache

router.push() can reuse a cached middleware redirect that was
issued before the cookie was set, sending the user back to /login.
window.location.href forces a fresh browser request that carries
the newly set access_token cookie.

Also changed SameSite=Strict -> SameSite=Lax so the cookie is
included in all same-site navigation patterns.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/app/(auth)/login/page.tsx

@@ -1,7 +1,6 @@
 'use client';
 
 import { useState, type FormEvent } from 'react';
-import { useRouter } from 'next/navigation';
 import { Button, Input, Card } from '@/components/ui';
 import { api } from '@/lib/api';
 import { useAuthStore } from '@/lib/store';
@@ -29,7 +28,6 @@ const ROLE_REDIRECT: Record<UserRole, string> = {
 };
 
 export default function LoginPage() {
-  const router = useRouter();
   const { setTokens, setUser } = useAuthStore();
 
   const [email, setEmail] = useState('');
@@ -52,7 +50,9 @@ export default function LoginPage() {
       if (!role) throw new Error('Не удалось определить роль пользователя');
 
       setUser({ ...profile, role });
-      router.push(ROLE_REDIRECT[role]);
+      // Hard redirect so the browser sends a fresh request with the new cookie.
+      // router.push() can use a stale Next.js router cache and miss the cookie.
+      window.location.href = ROLE_REDIRECT[role];
     } catch (e) {
       setError(e instanceof Error ? e.message : 'Ошибка входа');
     } finally {

frontend/lib/store.ts

@@ -22,7 +22,7 @@ function persistToken(accessToken: string): void {
   if (typeof window === 'undefined') return;
   localStorage.setItem('access_token', accessToken);
   // 15 min lifetime matches the default JWT_ACCESS_TTL
-  document.cookie = `access_token=${accessToken}; path=/; SameSite=Strict; max-age=900`;
+  document.cookie = `access_token=${accessToken}; path=/; SameSite=Lax; max-age=900`;
 }
 
 export const useAuthStore = create<AuthState>()(