rework pwa cc

vite.config.ts

@@ -61,6 +61,8 @@ export default defineConfig({
           },
         ],
         navigateFallback: "/index.html",
+        // Never let the SPA fallback swallow API calls.
+        navigateFallbackDenylist: [/^\/api/],
         cleanupOutdatedCaches: true,
       },
     }),
@@ -70,4 +72,14 @@ export default defineConfig({
       "@": path.resolve(__dirname, "./src"),
     },
   },
+  server: {
+    // Dev: forward /api to the backend so the browser sees a single origin
+    // (required for the httpOnly refresh cookie to work end-to-end).
+    proxy: {
+      "/api": {
+        target: "http://localhost:3001",
+        changeOrigin: true,
+      },
+    },
+  },
 });