chore(dev): allow tunnel host + all interfaces in Vite dev server

Reaching the dev PWA through the Pangolin/newt tunnel failed: Vite's default
host check 403s any non-localhost Host header ('Blocked request'), which the
tunnel health checks on / and /health read as unhealthy. Add allowedHosts:true
and host:true so the dev server accepts the tunnel hostname and listens on all
interfaces. Dev-only config; the production image serves the built PWA itself.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pwa/vite.config.ts

@@ -44,6 +44,13 @@ export default defineConfig({
     }),
   ],
   server: {
+    // Dev box reached through the Pangolin/newt tunnel: Vite's default host check
+    // 403s any non-localhost Host header ("Blocked request"), which the tunnel
+    // health check reads as unhealthy. `true` accepts any host (fine for a private
+    // throwaway dev tunnel); replace with e.g. ['familysync.example.com'] to scope it.
+    allowedHosts: true,
+    // Listen on all interfaces so newt can reach Vite via the box IP, not just localhost.
+    host: true,
     proxy: {
       '/health': 'http://localhost:3000',
       '/api': 'http://localhost:3000',

docker-compose.dev.yml

@@ -9,6 +9,10 @@ services:
       - ./apps/api/src:/app/apps/api/src
     environment:
       NODE_ENV: development
+      # Local-dev only: skip OIDC and authenticate as Dev User id 1. Guarded by
+      # NODE_ENV !== 'production' (and the production image bakes NODE_ENV=production),
+      # so this can never activate in a shipped image. Required by the e2e harness.
+      DEV_AUTH_BYPASS: 'true'
 
   mariadb:
     ports: