router.push() can reuse a cached middleware redirect that was
issued before the cookie was set, sending the user back to /login.
window.location.href forces a fresh browser request that carries
the newly set access_token cookie.
Also changed SameSite=Strict -> SameSite=Lax so the cookie is
included in all same-site navigation patterns.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>