session fix

apps/api/config/application.rb

@@ -22,6 +22,12 @@ module Api
     config.hosts << ENV["WEBAPP_TECHNICAL_DOMAIN"] if ENV["WEBAPP_TECHNICAL_DOMAIN"].present?
     config.hosts << "teletypegames.org"
 
+    # Trust Traefik and other Docker-internal proxies so Rails correctly reads
+    # X-Forwarded-Proto: https — required for CSRF origin check behind SSL termination
+    config.action_dispatch.trusted_proxies =
+      ActionDispatch::RemoteIp::TRUSTED_PROXIES +
+      [IPAddr.new("172.16.0.0/12"), IPAddr.new("10.0.0.0/8"), IPAddr.new("192.168.0.0/16")]
+
     config.autoload_lib(ignore: %w[assets tasks])
   end
 end