- Set VITE_API_BASE_URL default to production API URL in api-client.ts
so fetch() uses absolute URLs instead of relative paths that fail on Tauri
- Add tauri://localhost and https://tauri.localhost to API CORS allowed origins
- Also fix .env WEB_APP_URL from stale .tech to .my.id
Co-Authored-By: Claude <noreply@anthropic.com>
- Add environment-aware CORS and secure cookie support:
* Add secureCookies config to env.ts based on SECURE_COOKIES env var or https detection
* Integrate @elysiajs/cors with credentials and origin configuration
* Update cookie helpers to use SameSite=None; Secure in production
- Wrap expert review update and insert in database transaction for atomicity:
* Ensures diagnosis status update and review insert succeed together
* Rolls back both operations if either fails
* Preserves behavior: only update if status is needs_review, return badRequest if no row updated
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
