add trust proxy to fix cookies

apps/backend/src/index.ts

@@ -23,6 +23,13 @@ const redisClient = createClient({ url: env.REDIS_URL });
 redisClient.connect().catch(console.error);
 
 const app = express();
+
+// TLS terminates at Traefik and the SSR frontend proxies onward over plain
+// HTTP, so req.protocol is "http" here and the session cookie's `secure` flag
+// would silently suppress Set-Cookie. Trusting X-Forwarded-Proto restores it.
+// The only reachable client is that proxy, on an internal network.
+app.set("trust proxy", true);
+
 app.use(express.urlencoded({ extended: false }));
 app.use(express.json());