fix: include anthropic.com cookies in all auth checks and API requests

Claude session cookies are on anthropic.com, not claude.ai. The login
window was not detecting auth (Cancel stayed, no Done) and API calls
were sent without the actual session token.

- claudeCookieHeader: include anthropic.com cookies so the token is
  sent to the usage/bootstrap endpoints
- checkInitialSignInState: detect anthropic.com cookies on startup
- didFinish in LoginView: fire auth when anthropic.com cookies found
- signOut: clear anthropic.com data alongside claude.ai
- notAuthenticated catch: set isSignedIn = false so Settings stays
  in sync with the main panel

RELEASE_NOTES.md

@@ -6,4 +6,6 @@
 - Fixed login window auto-closing before the user could sign in — the login window now correctly loads the `/login` page so it only detects auth after the actual sign-in redirect
 - Fixed "No API key configured" showing after signing out — now correctly shows "Not signed in" with a prompt to sign in
 - Added `/api/organizations` as a final fallback for org ID resolution when the bootstrap API response doesn't include it
-- Fixed usage data not loading after sign-in — API requests now include required browser-like headers (Origin, Referer, User-Agent) that Claude's usage endpoints require
+- Fixed usage data not loading — API requests now include required browser-like headers (Origin, Referer, User-Agent)
+- Fixed sign-in detection and cookie handling for accounts whose session cookies are on the `anthropic.com` domain rather than `claude.ai`
+- Fixed Settings incorrectly showing "Signed in" after a failed refresh — sign-in state now resets when authentication fails