fix auth

docker-compose.yml

@@ -129,7 +129,13 @@ services:
     depends_on:
       - backend
     environment:
-      VITE_API_URL: ${VITE_API_URL:-http://localhost:8000}
+      # Used by Vite's dev-server proxy (vite.config.ts) to forward /api calls.
+      # Inside the frontend container, "localhost" refers to the container itself,
+      # NOT the host — so we point at the docker-compose service name "backend".
+      # The host port (8000) is still published for direct browser/curl access.
+      # Deliberately NOT prefixed with `VITE_` so it cannot leak into the browser
+      # bundle (browser code uses relative "/api" URLs only — see src/api/index.ts).
+      API_PROXY_TARGET: ${API_PROXY_TARGET:-http://backend:8000}
     ports:
       - "5173:5173"
       - "8080:80"