fix: WebSocket 403 — SameSite=Strict blocked session cookie on WS connections

Root cause: session_cookie_samesite was 'strict' which prevents the
browser from sending the session cookie on WebSocket upgrade requests.
Changed to 'lax' which allows WebSocket cookies while still blocking
cross-site POST CSRF attacks.

Also removed debug logging from kommunikation routes.

app/config.py

@@ -36,7 +36,7 @@ class Settings(BaseSettings):
     bcrypt_rounds: int = 12
     session_cookie_name: str = "leocrm_session"
     session_cookie_secure: bool = True  # Secure by default — set to False only for local HTTP development
-    session_cookie_samesite: str = "strict"
+    session_cookie_samesite: str = "lax"  # Lax allows WebSocket cookies; Strict blocks them
     session_cookie_httponly: bool = True
     password_reset_expiry_hours: int = 1