fix(security) : disable session migration on API firewall

Symfony's default session_fixation_strategy (migrate) regenerated the
session ID on every authenticated request, breaking concurrent API calls
from the SPA — only the first request succeeded, all others got 401.
The login controller already calls $session->migrate(true) explicitly,
so disabling automatic migration is safe.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

config/packages/security.yaml

@@ -1,4 +1,9 @@
 security:
+    # Login controller already calls $session->migrate(true) on login.
+    # Keeping 'migrate' would regenerate the session ID on every authenticated
+    # API request, which breaks concurrent requests from the SPA (race condition).
+    session_fixation_strategy: none
+
     # https://symfony.com/doc/current/security.html#registering-the-user-hashing-passwords
     password_hashers:
         Symfony\Component\Security\Core\User\PasswordAuthenticatedUserInterface: 'auto'