fix auth

frontend/vite.config.ts

@@ -14,7 +14,17 @@ export default defineConfig({
     port: 5173,
     proxy: {
       "/api": {
-        target: process.env.VITE_API_URL || "http://localhost:8000",
+        // NOTE: This URL is resolved INSIDE the vite dev-server container.
+        // `localhost` would refer to the container itself, not the host — so
+        // in docker-compose we set API_PROXY_TARGET=http://backend:8000 (the
+        // docker-compose service name). Outside docker (e.g. running vite
+        // locally against a backend on the host), leave it unset and the
+        // default http://localhost:8000 applies.
+        //
+        // Deliberately NOT prefixed with `VITE_` so it cannot leak into the
+        // browser bundle (browser code uses relative "/api" URLs only — see
+        // src/api/index.ts).
+        target: process.env.API_PROXY_TARGET || "http://localhost:8000",
         changeOrigin: true,
       },
     },