fix: clearCookie must match setCookie options for browser to clear it

clearCookie was missing httpOnly, secure, sameSite — browser ignored
the Set-Cookie header because the options didn't match the original
cookie attributes. Cookie persisted after logout, allowing F5 to
re-authenticate via silent refresh.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/routes/admin/auth.ts

@@ -158,7 +158,7 @@ export default async function authRoutes(fastify: FastifyInstance): Promise<void
     const result = await refreshAccessToken(refreshTokenRaw, request);
 
     if (result.type === 'error') {
-      reply.clearCookie('refresh_token', { path: '/api/admin' });
+      reply.clearCookie('refresh_token', { path: '/api/admin', httpOnly: true, secure: config.isProduction, sameSite: 'strict' });
       return error(reply, result.message, result.status);
     }
 
@@ -177,7 +177,7 @@ export default async function authRoutes(fastify: FastifyInstance): Promise<void
       await logout(refreshTokenRaw);
     }
 
-    reply.clearCookie('refresh_token', { path: '/api/admin' });
+    reply.clearCookie('refresh_token', { path: '/api/admin', httpOnly: true, secure: config.isProduction, sameSite: 'strict' });
     return success(reply, null, 200, 'Odhlášení úspěšné');
   });