Adds NewRbacServiceWithCookieName with startup validation; the existing constructor keeps token for compatibility. Reads only the configured cookie before Authorization, never cookies from other environments. Preserves JWT validation and authentication errors. Includes isolation tests and configuration documentation. Validation: go test -race ./... passed. Merge and publish a new RBAC tag before upgrading the six services; their AUTH_COOKIE setting must match the frontend in each environment.