fix: isolate auth cookies per deploy

frontend/app/lib/claw-auth.ts

@@ -10,7 +10,7 @@ const AUTH_STATE_ROOT = path.join(
 );
 const USERS_PATH = path.join(AUTH_STATE_ROOT, "users.json");
 const SESSIONS_PATH = path.join(AUTH_STATE_ROOT, "auth_sessions.json");
-const COOKIE_NAME = "claw_account_session";
+const COOKIE_NAME = authCookieName();
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 24 * 30;
 const SESSION_REFRESH_INTERVAL_MS = 60 * 60 * 12 * 1000;
 const LINUX_ACCOUNT_WORKSPACE_NAME = "zk-agent";
@@ -303,6 +303,23 @@ function shouldRefreshSession(value?: string) {
 	return Date.now() - timestamp > SESSION_REFRESH_INTERVAL_MS;
 }
 
+function authCookieName() {
+	const explicit = sanitizeCookieNamePart(process.env.CLAW_AUTH_COOKIE_NAME);
+	if (explicit) return explicit;
+	const instance =
+		sanitizeCookieNamePart(process.env.CLAW_DEPLOY_INSTANCE) ||
+		sanitizeCookieNamePart(process.env.CLAW_SERVICE_SCOPE) ||
+		"local";
+	const port = sanitizeCookieNamePart(process.env.CLAW_FRONTEND_PORT) || "dev";
+	return `claw_account_session_${instance}_${port}`;
+}
+
+function sanitizeCookieNamePart(value?: string) {
+	const normalized = (value ?? "").trim().toLowerCase();
+	if (!normalized) return "";
+	return normalized.replace(/[^a-z0-9_-]+/g, "_").replace(/^_+|_+$/g, "");
+}
+
 function linuxAccountsEnabled() {
 	return ["1", "true", "yes", "on"].includes(
 		(process.env.CLAW_ENABLE_LINUX_ACCOUNTS ?? "").trim().toLowerCase(),