Problem: dev runs the dashboard on :3000 and the API on :3001 (STX_PUBLIC_API_ENDPOINT). Dashboard fetches omit credentials, and the API answers Access-Control-Allow-Origin: * — which forbids credentials — so the session cookie can never reach the API cross-origin and login cannot work in the dev split.
Scope: dashboard fetch paths send credentials: 'include'; /api/* responses echo the request Origin + Access-Control-Allow-Credentials: true (collect/script endpoints keep * — they are public and cookie-free).
Done when: login on :3000 yields an authenticated session for all :3001 API calls.