feat: same-origin auth via reverse proxy and secure cookies

Route /api/auth through the same origin in both dev and prod so
cookies stay first-party and the browser and React Router SSR share
one auth surface.

- Vite dev server proxies /api/auth to the Convex HTTP site.
- Better Auth uses secure cookies when the site URL is https.
- Add docs/auth-proxy.md documenting the required production ingress
  (Caddy/Traefik) and Convex SITE_URL / CONVEX_SITE_URL setup.

apps/web/vite.config.ts

@@ -7,14 +7,17 @@ import { defineConfig } from "vite-plus";
 export default defineConfig({
   envDir: path.resolve(import.meta.dirname, "../.."),
   plugins: [tailwindcss(), reactRouter()],
-  ssr: {
-    noExternal: true,
-  },
   resolve: {
     dedupe: ["convex", "react", "react-dom"],
     tsconfigPaths: true,
   },
   server: {
     allowedHosts: true,
+    proxy: {
+      "/api/auth": {
+        changeOrigin: true,
+        target: "https://befitting-dalmatian-161.convex.site",
+      },
+    },
   },
 });