fix(liveview): SameSite=None on live cookie so the cross-site iframe sends it

[jrothrock]

The bug

Live View showed a white screen even after the frame-ancestors CSP fix (#407). Root cause is a second cross-origin problem underneath the CSP one: the live-auth cookie was SameSite=Strict.

The iframe's origin is localhost:<livePort> but it is embedded by the dashboard at 127.0.0.1:<dashPort>. Browsers treat localhost and 127.0.0.1 as different sites, so every request the iframe makes is cross-site (third-party). A Strict/Lax cookie is never sent there:

1. Iframe loads …?__live_token=X → server 302s and sets the Strict cookie.
2. Browser follows to the clean URL — framed, third-party, no token param → cookie withheld → 403 → white screen.

verify-live-view never caught this: it loads the URL top-level (first-party), where Strict works fine — so it reported rendered: true while the browser stayed white.

The fix

SameSite=None; Secure — the only cookie sent in a cross-site context. Browsers accept Secure cookies over http://localhost as a loopback exception, so it works on plain HTTP.

Not a security regression

SameSite controls when the cookie is sent, not who can read it. The token is single-purpose (authorizes framing the sandbox app, zero dashboard access — dashboard uses a separate corral_dash_token on 127.0.0.1, never sent to localhost). Still HttpOnly (framed app JS can't read it) and host-only loopback. Framing remains gated by the CSP frame-ancestors allowlist (loopback dashboard origins only). The untrusted-app → dashboard barrier is unchanged.

Test TestRequireLiveAuth now asserts SameSite=None; Secure so this can't regress.

🤖 Generated with Claude Code