fix: Add SESSION_DOMAIN="" to all test jobs in workflows

Cookie domain=localhost doesn't match TestClient's internal hostname,
causing cookies to not be parsed into response.cookies object.
Setting SESSION_DOMAIN="" removes the domain attribute, allowing cookies
to work with any host.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: Spacehunterz

.github/workflows/security-tests.yml

@@ -38,6 +38,7 @@ jobs:
         env:
           SESSION_ENCRYPTION_KEY: ${{ secrets.TEST_SESSION_ENCRYPTION_KEY || 'QgL6WE5rriiPpNBid3KZS8XXxMViqgoop57l30nF7n0=' }}
           DEV_ACCESS_TOKEN: ${{ secrets.TEST_DEV_ACCESS_TOKEN || 'test-dev-token-for-ci' }}
+          SESSION_DOMAIN: ""
 
       - name: Upload coverage to Codecov
         uses: codecov/codecov-action@v4
@@ -85,6 +86,7 @@ jobs:
         env:
           SESSION_ENCRYPTION_KEY: ${{ secrets.TEST_SESSION_ENCRYPTION_KEY || 'QgL6WE5rriiPpNBid3KZS8XXxMViqgoop57l30nF7n0=' }}
           DEV_ACCESS_TOKEN: ${{ secrets.TEST_DEV_ACCESS_TOKEN || 'test-dev-token-for-ci' }}
+          SESSION_DOMAIN: ""
           REDIS_HOST: localhost
           REDIS_PORT: 6379
 
@@ -116,6 +118,7 @@ jobs:
         env:
           SESSION_ENCRYPTION_KEY: ${{ secrets.TEST_SESSION_ENCRYPTION_KEY || 'QgL6WE5rriiPpNBid3KZS8XXxMViqgoop57l30nF7n0=' }}
           DEV_ACCESS_TOKEN: ${{ secrets.TEST_DEV_ACCESS_TOKEN || 'test-dev-token-for-ci' }}
+          SESSION_DOMAIN: ""
 
   coverage-check:
     name: Coverage Validation
@@ -146,6 +149,7 @@ jobs:
         env:
           SESSION_ENCRYPTION_KEY: ${{ secrets.TEST_SESSION_ENCRYPTION_KEY || 'QgL6WE5rriiPpNBid3KZS8XXxMViqgoop57l30nF7n0=' }}
           DEV_ACCESS_TOKEN: ${{ secrets.TEST_DEV_ACCESS_TOKEN || 'test-dev-token-for-ci' }}
+          SESSION_DOMAIN: ""
 
       - name: Upload coverage report
         uses: actions/upload-artifact@v4

.github/workflows/tests.yml

@@ -96,6 +96,7 @@ jobs:
         env:
           SESSION_ENCRYPTION_KEY: ${{ secrets.TEST_SESSION_ENCRYPTION_KEY || 'QgL6WE5rriiPpNBid3KZS8XXxMViqgoop57l30nF7n0=' }}
           DEV_ACCESS_TOKEN: ${{ secrets.TEST_DEV_ACCESS_TOKEN || 'test-dev-token-for-ci' }}
+          SESSION_DOMAIN: ""
 
   frontend-tests:
     name: Frontend Tests

apps/dashboard/backend/tests/conftest.py

@@ -206,8 +206,8 @@ def app():
         os.environ["DEV_ACCESS_TOKEN"] = secrets.token_hex(32)
     if not os.environ.get("GITHUB_CLIENT_ID"):
         os.environ["GITHUB_CLIENT_ID"] = "mock"
-    if not os.environ.get("SESSION_DOMAIN"):
-        os.environ["SESSION_DOMAIN"] = "localhost"
+    # SESSION_DOMAIN must be empty for TestClient - domain=localhost doesn't match testclient's host
+    os.environ["SESSION_DOMAIN"] = ""
     os.environ["ENVIRONMENT"] = "test"
 
     # Import after env vars are set