Safari drops `p_oidc_state` cookie on OIDC callback, missing state error

### Describe the Bug

When using Safari with Pangolin + Pocket-ID (OIDC), the login fails with:
"There was a problem connecting to Pocket-ID... The login request is missing state information."

Pangolin sets the `p_oidc_state` cookie on `/auth/login`, but Safari does not send it back on the OIDC callback, so Pangolin cannot validate state. Chrome works normally.

### Evidence (Traefik access logs)
Safari run (fails):
```
2026-01-22T01:10:34.493Z /auth/login ...
Set-Cookie: p_oidc_state=; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax

2026-01-22T01:10:35.847Z /auth/idp/1/oidc/callback?...
request_Cookie: pangolin-last-org=sammykins-homelab
```

Chrome run (succeeds):
```
2026-01-22T01:11:07.075Z /auth/login ...
Set-Cookie: p_oidc_state=; Path=/; Expires=...; Domain=pangolin.TLD.au; HttpOnly; SameSite=lax

2026-01-22T01:11:11.885Z /auth/idp/1/oidc/callback?...
request_Cookie: pangolin-last-org=sammykins-homelab; p_oidc_state=
```

### Evidence (Pangolin logs)
Chrome run (success):
```
2026-01-22T01:11:12+00:00 POST /api/v1/auth/idp/1/oidc/validate-callback
2026-01-22T01:11:12+00:00 State verified {"expectedState":"","state":""}
```

### Notes
- Pocket-ID `/authorize` requests succeed in both Safari and Chrome.
- This appears to be a Safari cookie handling issue on the Pangolin callback (state cookie not sent).

### Environment

- Pangolin: fosrl/pangolin:ee-1.14.1
- Pocket‑ID: ghcr.io/pocket-id/pocket-id:v2 (2.2.0)
- Traefik: traefik:v3.6
- Gerbil: fosrl/gerbil:1.3.0
- Pangolin URL: `https://pangolin.TLD.com`
- Pocket‑ID URL: `https://auth.TLD.com`
- Safari: Version 26.3 (21623.2.4.11.1)
- Chrome: Chromium Engine Version 144.0.7559.60

### To Reproduce

1. Open Safari.
2. Navigate to `https://pangolin.TLD.com`.
3. Select Pocket‑ID as identity provider.
4. Complete login (passkey, via Apple Password).
5. Observe error: “missing state information”.

### Expected Behavior

OIDC login completes successfully.