session fix 2

apps/api/config/application.rb

@@ -22,11 +22,9 @@ module Api
     config.hosts << ENV["WEBAPP_TECHNICAL_DOMAIN"] if ENV["WEBAPP_TECHNICAL_DOMAIN"].present?
     config.hosts << "teletypegames.org"
 
-    # Trust Traefik and other Docker-internal proxies so Rails correctly reads
-    # X-Forwarded-Proto: https — required for CSRF origin check behind SSL termination
-    config.action_dispatch.trusted_proxies =
-      ActionDispatch::RemoteIp::TRUSTED_PROXIES +
-      [IPAddr.new("172.16.0.0/12"), IPAddr.new("10.0.0.0/8"), IPAddr.new("192.168.0.0/16")]
+    # Traefik terminates SSL so Rails sees HTTP internally; disable the origin
+    # header check (CSRF token itself is still validated)
+    config.action_dispatch.forgery_protection_origin_check = false
 
     config.autoload_lib(ignore: %w[assets tasks])
   end