changes

.env.example

@@ -36,6 +36,23 @@
 # comment is longer than the value.
 VITE_API_BASE_URL=/api/v1
 
+# PRODUCTION BUILDS ARE DIFFERENT. The relative value above is correct only
+# where something on the page's own origin forwards /api — the Vite proxy in
+# development. The deployed frontend at platform.krowforce.com is a static nginx
+# host with no such forward (see nginx.conf: no `location /api/`), so a relative
+# path makes the login POST land on a static route and answer 405 Method Not
+# Allowed.
+#
+# The production value is therefore absolute, and it is set as a build-time
+# environment variable rather than here, because .dockerignore excludes .env*
+# and no env file reaches the image build:
+#
+#   ARG VITE_API_BASE_URL=https://mcp.krowforce.com/api/v1   (see Dockerfile)
+#
+# platform.krowforce.com and mcp.krowforce.com are different origins but the
+# same site, so the SameSite=Lax session cookie is still sent — which is why
+# production works cross-origin while localhost cannot.
+
 # Where the Vite dev proxy forwards /api. Only read by vite.config.js, never by
 # client code.
 VITE_API_PROXY_TARGET=https://mcp.krowforce.com