Design a backend that must simultaneously support a traditional server-rendered web client (session-cookie based) and a newer mobile app (JWT-based), sharing the same underlying business logic.

Configure two separate SecurityFilterChain beans with distinct @Order values and securityMatchers: one scoped to the web UI's routes using formLogin() with SessionCreationPolicy.IF_REQUIRED (or default), and another scoped to /api/** using SessionCreationPolicy.STATELESS with JWT bearer-token validation. Both chains ultimately resolve to the SAME UserDetailsService/business services underneath, so the dual authentication mechanisms are purely a concern of the security configuration layer, not duplicated business logic.