Wrap SPA auth endpoints with 'web' middleware so session cookies persist

[RichPC]

Problem

• SPA auth endpoints were registered under API routes without the 'web' middleware. Session middleware was not applied, so login didn't persist authentication.

Fix

• Wrap SPA auth endpoints (login, register, social callbacks, password, verification) in Route::middleware('web')->group(...).

Verification

• Reproduced login flow locally; session and auth persisted and /api/v1/user returns authenticated user.

[RichPC]

I've since found this causes problems. Having 'web' and 'auth:sanctum' middleware on route group in laravel 12 can cause session to be droped, e.g. login - works, get request works (but comes back with a new session cookie) second get request to same route fails because session got rotated.