#1144 fix(auth): magic-link verify drops auth cookie on fresh browsers (#1101)

Problem

When a user clicks a magic link from a browser that has no csrf_token cookie (fresh browser / first visit), the login silently fails — the redirect to /admin/dashboard completes but no auth_token cookie is set.

Root Cause

Same Hono c.res setter merge bug already fixed for the Better Auth handler in app.ts (lines 795–807):

1. csrfProtection() middleware calls ensureCsrfCookie() on the GET request, queuing a csrf_token Set-Cookie on the context
2. The verify handler calls AuthManager.setAuthCookie() which uses Hono's setCookie()
3. When the handler returns c.redirect(), Hono's response merger keeps the old (CSRF) cookies and discards the new response's cookies
4. Result: user gets a csrf_token but no auth_token → not signed in

Fix

Replace setAuthCookie() with a direct c.header('set-cookie', ..., { append: true }) call before the redirect — the same pattern used in app.ts for Better Auth's session cookie.

Closes #1101

Confidence Score: 4/5

The required Playwright regression spec must be added before merging.

Findings

1.  Required regression test is missing ▶

Summary

The PR writes the magic-link auth cookie directly before redirecting so it survives alongside a fresh CSRF cookie.

• Magic-link redirects keep the auth cookie in fresh browsers.
• Playwright wiring checks ignore reporter settings when comparing configs.

_{Reviews (5) · Last reviewed commit: "test(ci): anchor reporting preservation ..." · Reviewed by Greptile}