ac768ed0db
Cookie was silently never set because NODE_ENV=production forced secure=true while the app is served over plain HTTP on the LAN (TLS terminates at a reverse proxy later, not here). Add explicit COOKIE_SECURE env var, default false. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>