Session Cookie Auth, Forgot-Password Timeouts, and Killing Flaky E2E Tests

Hustle, a youth soccer stats platform on Next.js 15 and Firebase, suffered three auth-related bugs: premature logouts caused by storing raw Firebase ID tokens (1-hour expiry) in 14-day cookies, 504 timeouts on the forgot-password endpoint due to dynamic imports on cold starts, and flaky Playwright E2E tests. Fixes included switching to Firebase's createSessionCookie() API, replacing dynamic imports with static ones, and moving password reset to the client-side Firebase SDK.