Fix iframe cookie issues for HF Spaces

Based on HF official docs about iframe cookie problems:

1. Ensure SameSite=None for iframe cookies in HF Spaces
- Critical for cross-origin iframe cookie support

2. Add target='_blank' to login button
- Opens login in new tab as recommended by HF docs
- Avoids iframe cookie restrictions

3. Add auto-refresh login detection
- JavaScript checks login status every 3s
- Auto-redirects when user is authenticated
- Better UX for iframe login flow

This should fix the session persistence issue we've been seeing.

backend/app.py

@@ -72,8 +72,8 @@ if is_huggingface_space():
     app.add_middleware(
         SessionMiddleware,
         secret_key=session_secret,
-        max_age=3600,  # Shorter expiry for HF Spaces (1 hour)
-        same_site="none",  # More permissive for HF Spaces proxy
+        max_age=3600,  # Shorter expiry for HF Spaces (1 hour)  
+        same_site="none",  # CRITICAL: Required for iframe cookies in HF Spaces
         https_only=True,  # HF Spaces uses HTTPS
         # Note: SessionMiddleware doesn't support custom cookie name, using default
     )

backend/routers/auth.py

@@ -337,13 +337,33 @@ async def login_page(request: Request):
                 • Maintains service quality and availability
             </div>
             
-            <p>Please log in with your Hugging Face account to continue.</p>
-            <a href="/auth/login" class="login-btn">🚀 Login with Hugging Face</a>
+                <p>Please log in with your Hugging Face account to continue.</p>
+                <a href="/auth/login" class="login-btn" target="_blank">🚀 Login with Hugging Face</a>
+                
+                <p style="margin-top: 20px; font-size: 12px; color: #666;">
+                    <strong>Note:</strong> The login will open in a new tab. After logging in, please close the tab and refresh this page.
+                </p>
             
             <p style="margin-top: 30px; font-size: 12px; color: #888;">
                 By logging in, you agree to use this service responsibly and in accordance with our usage policies.
             </p>
         </div>
+        
+        <script>
+        // Check for login status every 3 seconds
+        setInterval(async function() {
+            try {
+                const response = await fetch('/auth/status');
+                const data = await response.json();
+                if (data.user_authenticated) {
+                    // User is logged in, redirect to main app
+                    window.location.href = '/';
+                }
+            } catch (error) {
+                console.log('Checking login status...');
+            }
+        }, 3000);
+        </script>
     </body>
     </html>
     """