fix: logout 端点添加 domain 参数清除跨域 cookie

- logout 端点清除 cookie 时添加 domain 参数
- 修复 .tlyq.ai 域的 tlyq_session cookie 未正确清除的问题

src/app/api/auth/logout/route.ts

@@ -6,9 +6,12 @@ import { writeAuditLog, getClientIP } from '@/lib/audit'
 export async function POST(request: Request) {
   const session = await getSession()
   const cookieStore = await cookies()
-  cookieStore.set('session_assets', '', { maxAge: 0, path: '/' })
-  cookieStore.set('tlyq_session', '', { maxAge: 0, path: '/' })
-  cookieStore.set('oidc_id_token', '', { maxAge: 0, path: '/' })
+  const domain = process.env.COOKIE_DOMAIN || ''
+
+  // 清除 cookie 时必须指定与设置时相同的 domain
+  cookieStore.set('session_assets', '', { maxAge: 0, path: '/', domain })
+  cookieStore.set('tlyq_session', '', { maxAge: 0, path: '/', domain })
+  cookieStore.set('oidc_id_token', '', { maxAge: 0, path: '/', domain })
 
   if (session) {
     writeAuditLog({