Hardcoded cookie Domain=.popsigner.com breaks login on self-hosted deployments

### Summary

Every auth cookie in `control-plane/cmd/server/main.go` hardcodes `Domain: ".popsigner.com"` (7 sites, e.g. the session cookie at `oauthCallbackHandler`). A self-hosted control-plane on any other hostname can never log in: the browser rejects the `Set-Cookie` because the Domain attribute doesn't match the host, so `/login` loops forever.

### Steps to reproduce

1. Run `cmd/server` behind any hostname other than `*.popsigner.com`.
2. Complete the Google OAuth flow.
3. The callback sets `banhbao_session` with `Domain=.popsigner.com`; the browser drops it; the dashboard redirects back to `/login`.

### Proposed fix

Make the domain a config value (`auth.cookie_domain`, env `BANHBAO_AUTH_COOKIE_DOMAIN`) defaulting to the current `.popsigner.com` so popsigner.com deployments are unaffected; empty string ⇒ host-only cookies.

Start in control-plane/cmd/server/main.go, especially oauthCallbackHandler and the other cookie sites that hardcode the Domain attribute. Trace the existing configuration path for auth.cookie_domain and BANHBAO_AUTH_COOKIE_DOMAIN, then verify that the default preserves .popsigner.com and an empty value produces host-only cookies so self-hosted login completes.

Written by the indexing model from the issue text.