fix(auth): preserve query params in OAuth callback redirect

When an unauthenticated user landed on /oauth/callback?code=..., the
ProtectedRoute component was only saving location.pathname in the
redirect state, losing the query parameters. After login, the user
was redirected to /oauth/callback without the code parameter, causing
"Paramètres de callback invalides" error.

Changes:
- ProtectedRoute now saves pathname + search in redirect state
- Added Vite proxy for /api/* to enable same-origin httpOnly cookies
- Mount .env.web in frontend container for runtime env configuration

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <[email protected]>

Author: Clément VALENTIN

apps/web/src/App.tsx

@@ -61,8 +61,9 @@ function ProtectedRoute({ children }: { children: React.ReactNode }) {
   }
 
   if (!isAuthenticated) {
-    // Sauvegarder l'URL courante pour y revenir après connexion
-    return <Navigate to="/login" state={{ from: location.pathname }} replace />
+    // Sauvegarder l'URL courante (avec query params) pour y revenir après connexion
+    const fullPath = location.pathname + location.search
+    return <Navigate to="/login" state={{ from: fullPath }} replace />
   }
 
   return <>{children}</>

apps/web/vite.config.ts

@@ -8,7 +8,8 @@ const __dirname = dirname(__filename)
 
 export default defineConfig(({ mode }) => {
   const env = loadEnv(mode, process.cwd(), '')
-  const backendUrl = env.VITE_BACKEND_URL || 'http://127.0.0.1:8000'
+  // Use process.env first (from Docker env_file), then loadEnv, then default
+  const backendUrl = process.env.VITE_BACKEND_URL || env.VITE_BACKEND_URL || 'http://backend:8000'
 
   return {
     plugins: [react()],
@@ -75,6 +76,16 @@ export default defineConfig(({ mode }) => {
       hmr: {
         clientPort: 8000,
       },
+      // Proxy API requests to backend - ensures same-origin for httpOnly cookies
+      proxy: {
+        '/api': {
+          target: backendUrl,
+          changeOrigin: true,
+          rewrite: (path) => path.replace(/^\/api/, ''),
+          // Forward cookies
+          cookieDomainRewrite: 'localhost',
+        },
+      },
     },
     test: {
       globals: true,

docker-compose.yml

@@ -104,6 +104,7 @@ services:
       - ./apps/web/tsconfig.node.json:/app/tsconfig.node.json
       - ./apps/web/tailwind.config.js:/app/tailwind.config.js
       - ./apps/web/postcss.config.js:/app/postcss.config.js
+      - ./.env.web:/app/.env:ro
       - /app/node_modules
     ports:
       - "8000:5173"