fix(auth): add Vite dev proxy to fix SameSite=Strict cookie on page reload

Chrome 89+ treats http://localhost and https://localhost as different sites
(schemeful same-site). The refreshToken cookie (SameSite=Strict) was not
sent when the Vite dev server (HTTP) made cross-origin fetch calls to the
.NET backend (HTTPS), causing a 401 on every page reload.

Fix: route /api/* through the Vite dev server proxy so all requests stay
same-origin. The cookie is now always sent and auth sessions survive reloads.

- vite.config.ts: proxy /api → https://localhost:7221 (secure:false for dev cert)
- .env.example: document proxy vs direct mode, set default VITE_API_BASE_URL to empty
- config.ts: accept empty string as valid apiBaseUrl alongside full URLs

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

frontend/vite.config.ts

@@ -14,6 +14,17 @@ export default defineConfig({
     },
     server: {
         port: 5173,
+        proxy: {
+            // Route all /api calls through the Vite dev server so the browser
+            // sees a single origin. Without this the refreshToken cookie
+            // (SameSite=Strict) is not sent from http://localhost to
+            // https://localhost (different scheme = cross-site in Chrome 89+).
+            '/api': {
+                target: 'https://localhost:7221',
+                changeOrigin: true,
+                secure: false, // allow self-signed dev cert
+            },
+        },
     },
     test: {
         globals: true,