Summary

Fixes the contact form, which was unusable in production: the captcha never validated and, after a successful submit, the thank-you redirect returned 404.

Related issue: LibreCodeCoop/management#482.

Changes

• Captcha session cookie (cross-origin): send the session cookie as SameSite=None; Secure under HTTPS so it survives the cross-origin flow between the site and contactform.libresign.coop; falls back to Lax on plain HTTP for same-origin local dev. Configuration lives in the autoloaded helper App\Support\Http\SessionCookie::configureCrossSite(), called before every session_start() in captcha.php, validate.php and audio_captcha.php.
• Session lock / 504: call session_write_close() before the SuiteCRM request and add CURLOPT_CONNECTTIMEOUT/CURLOPT_TIMEOUT in validate.php, so a slow or unreachable CRM no longer holds the session lock and makes captcha.php time out (which caused the captcha image to disappear).
• Thank-you redirect: redirect using an absolute, locale-aware URL (locale_url) instead of a relative path that resolved under /contact-us/ on pretty-URL hosting.