fix: cookies doc

[vinckr]

Related Issue or Design Document

Checklist

• I have read the contributing guidelines and signed the CLA.
• I have referenced an issue containing the design document if my change introduces a new feature.
• I have read the security policy.
• I confirm that this pull request does not address a security vulnerability.
  If this pull request addresses a security vulnerability,
  I confirm that I got approval (please contact security@ory.com) from the maintainers to push the changes.
• I have added tests that prove my fix is effective or that my feature works.
• I have added the necessary documentation within the code base (if appropriate).

Further comments

[Copilot]

Pull request overview

Updates the Ory Hydra “Configuring cookies” guide to better explain cookie-related configuration options (especially SameSite) and common browser/runtime constraints.

Changes:

• Expands SameSite documentation, including modern browser third-party cookie restrictions and legacy compatibility behavior.
• Adds sections describing cookie domain, path, names (including defaults), and development-mode Secure behavior.
• Updates configuration examples to reflect the recommended settings described in the guide.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This section links both "back-channel logout" and "front-channel logout" to the same target (./logout), which makes the comparison confusing. Consider linking to distinct anchors (e.g., sections for back-channel vs front-channel) or rewording to link once to the general logout guide.

Suggested change

	Host Hydra on the same eTLD+1 as your application and use `SameSite=Lax` whenever possible. For cross-domain logout, prefer
	[back-channel logout](./logout) over [front-channel logout](./logout) iframes. Embedding the login, consent, or other
	Host Hydra on the same eTLD+1 as your application and use `SameSite=Lax` whenever possible. For cross-domain logout, see the
	[logout guide](./logout) and prefer back-channel logout over front-channel logout iframes. Embedding the login, consent, or other

[Copilot]

The text says the default serve.cookies.same_site_mode is None, but the immediately following YAML example sets it to Lax without explaining that this is a recommended override. To avoid readers thinking Lax is the default, either adjust the example to show None or add a short note that the snippet is an example recommendation.