feat(analytics-browser): resolve duplicate cookie via last write

[daniel-graham-amplitude]

Summary

• adds new configuration to CookieOptions called resolveMultipleCookiesBy that is domain by default but can be set to lastWriteTime.
• when set to lastWriteTime, the SDK changes the way it deals with multiple cookies. If it sees multiple cookies with the same name, it will read the one that was written to the most recently (denoted by a new parameter lastWriteTime, falls back to lastEventTime to support backwards compatibility)
• there is a possibility that we'll make this the default behaviour as this seems the most logical (prior to January the SDK had no way to resolve duplicate cookies, and then we introduced resolution based on domain name)

Screen.Recording.2026-03-05.at.4.24.12.PM.mov

Checklist

• Does your PR title have the correct title format?
• Does your PR have a breaking change?:

---

Note

Medium Risk
Touches identity persistence and cookie read/write paths; incorrect resolution could restore the wrong userId/sessionId when duplicate cookies exist, though the change is scoped and covered by new tests.

Overview
Improves duplicate-cookie handling by persisting a lastWriteTime into the UserSession cookie payload and, during useBrowserConfig, selecting the most recently written session when multiple cookies with the same key are present.

Adds CookieStorage.getAll() (optional on the Storage interface) plus new browser storage-helpers and tests to support deterministic resolution, with a small test-server tweak to allow cookie-domain experimentation.

^{Written by Cursor Bugbot for commit ab0d16c. This will update automatically on new commits. Configure here.}

[daniel-graham-amplitude]

bugbot run

[daniel-graham-amplitude]

bugbot run

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR