Fix kiosk login colliding with real staff login

Kiosk sessions were minted under the same cookie name ('hnf_session') as a
real staff session, on the same origin -- the browser can end up holding two
same-named cookies with different scope with no guarantee which one it sends,
so a valid staff login could get shadowed by a stale kiosk cookie (hit
2026-08-26 testing kiosk login on a desktop browser, then unable to log into
the normal manage pages).

Fix: kiosk sessions now live in their own cookie, 'hvac_kiosk_session',
completely independent of the real staff session. hvac's requireAuth checks
hnf_session first, falls back to hvac_kiosk_session. Also dropped the
now-unneeded DOMAIN cross-subdomain cookie scoping -- this cookie is only
ever read by hvac's own backend, so a plain host-scoped cookie is simplest.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docker-compose.yml

@@ -6,10 +6,6 @@ services:
     environment:
       - DATABASE_URL=${DATABASE_URL}
       - CENTRAL_AUTH_SECRET=${CENTRAL_AUTH_SECRET}
-      # Only needed for the kiosk login (routes/kiosk.js), which mints its own
-      # hnf_session cookie locally — matches central auth's own cookie domain
-      # scoping (auth/src/routes/auth.js cookieOpts()) so the two are interchangeable.
-      - DOMAIN=${DOMAIN}
       - SETTINGS_URL=${SETTINGS_URL}
       - SETTINGS_SECRET=${SETTINGS_SECRET}
       - APP_SLUG=hvac