Merge remote-tracking branch 'origin/main' into gsd/phase-18-auto-timezone-detection-and-ability-to-change-timezone

# Conflicts:
#	apps/pwa/vite.config.ts

apps/pwa/vite.config.ts

@@ -44,10 +44,13 @@ export default defineConfig({
     }),
   ],
   server: {
-    // Allow the internal split-DNS domain (and any subdomain) to reach the dev
-    // server through the reverse proxy / tunnel. A leading dot matches the apex
-    // and all subdomains. Dev-server only — production builds ignore this.
-    allowedHosts: ['.bergerhouse.net'],
+    // Dev box reached through the Pangolin/newt tunnel: Vite's default host check
+    // 403s any non-localhost Host header ("Blocked request"), which the tunnel
+    // health check reads as unhealthy. `true` accepts any host (fine for a private
+    // throwaway dev tunnel); replace with e.g. ['familysync.example.com'] to scope it.
+    allowedHosts: true,
+    // Listen on all interfaces so newt can reach Vite via the box IP, not just localhost.
+    host: true,
     proxy: {
       '/health': 'http://localhost:3000',
       '/api': 'http://localhost:3000',