Initial

frontend/vite.config.js

@@ -0,0 +1,24 @@
+import { defineConfig } from 'vite'
+import react from '@vitejs/plugin-react'
+
+// The app calls the API with relative /api/... paths, so nothing in the source
+// needs to know where the backend lives. In dev Vite proxies that prefix to the
+// backend; in production nginx does the same (see nginx.conf.example). Either
+// way the browser sees a single origin, so the session (httpOnly) and csrf
+// cookies behave identically.
+//
+// Point at a different backend with BACKEND_URL=http://host:port npm run dev
+const backend = process.env.BACKEND_URL || 'http://localhost:8080'
+
+export default defineConfig({
+  plugins: [react()],
+  server: {
+    port: 5173,
+    proxy: {
+      '/api': {
+        target: backend,
+        changeOrigin: false,
+      },
+    },
+  },
+})