refactor: centralize access token handling in cookies and improve related functions

- Introduced utility functions for managing access tokens in cookies, including setting, getting, and clearing tokens.
- Updated various components and server routes to utilize the new access token functions for better consistency and maintainability.
- Removed redundant cookie handling code across the application, streamlining the authentication process.

frontend/src/lib/server/api.ts

@@ -4,6 +4,11 @@
  */
 
 import { redirect, type Cookies } from '@sveltejs/kit';
+import {
+	clearAccessTokenCookies,
+	getAccessTokenFromCookies,
+	setAccessTokenCookies
+} from '$lib/server/access-token-cookie';
 
 /**
  * Obtiene y normaliza la URL base de la API para llamadas desde el servidor
@@ -34,7 +39,7 @@ export function getServerApiUrl(): string {
  */
 export function getAuthTokens(cookies: Cookies) {
 	return {
-		accessToken: cookies.get('access_token'),
+		accessToken: getAccessTokenFromCookies(cookies),
 		refreshToken: cookies.get('refresh_token')
 	};
 }
@@ -43,7 +48,7 @@ export function getAuthTokens(cookies: Cookies) {
  * Establece los tokens de autenticación en las cookies
  *
  * Política de seguridad:
- *  - access_token  → NO HttpOnly (el cliente necesita incluirlo en el header Authorization)
+ *  - access_token  → NO HttpOnly (Bearer desde JS); si el JWT es muy grande, varias cookies fragmentadas
  *  - refresh_token → HttpOnly=true (JS nunca lo lee; el servidor lo maneja via /api-sveltekit/auth/silent-refresh)
  */
 export function setAuthTokens(
@@ -51,10 +56,7 @@ export function setAuthTokens(
 	accessToken: string,
 	refreshToken?: string
 ) {
-	cookies.set('access_token', accessToken, {
-		path: '/',
-		httpOnly: false,   // El cliente JS necesita leerlo para el header Bearer
-		sameSite: 'lax',
+	setAccessTokenCookies(cookies, accessToken, {
 		secure: process.env.NODE_ENV === 'production',
 		maxAge: 60 * 60 * 24 * 7 // 7 días
 	});
@@ -74,7 +76,7 @@ export function setAuthTokens(
  * Limpia todos los tokens de autenticación de las cookies
  */
 export function clearAuthTokens(cookies: Cookies) {
-	cookies.delete('access_token', { path: '/' });
+	clearAccessTokenCookies(cookies);
 	cookies.delete('refresh_token', { path: '/' });
 	cookies.delete('active_company_id', { path: '/' });
 }