Implement cross-domain support for OAuth and API requests

- Updated frontend to use `https://cms.gallus-pub.ch` as the API base URL.
- Configured cookies with `SameSite=None` and `Secure` for production in `auth.ts`.
- Enhanced `fly.toml` to include `FRONTEND_URL`, `CORS_ORIGIN`, and `GITEA_REDIRECT_URI`.
- Adjusted `.gitignore` to ignore `/ai/` directory.

backend/fly.toml

@@ -10,6 +10,10 @@ primary_region = "ams"
   GITEA_URL = "https://git.bookageek.ch"
   DATABASE_PATH = "/app/data/gallus_cms.db"
   GIT_WORKSPACE_DIR = "/app/data/workspace"
+  # Cross-site frontend and OAuth
+  FRONTEND_URL = "https://gallus-pub.ch"
+  CORS_ORIGIN = "https://gallus-pub.ch"
+  GITEA_REDIRECT_URI = "https://cms.gallus-pub.ch/api/auth/callback"
 
 [http_service]
   internal_port = 8080

backend/src/routes/auth.ts

@@ -122,11 +122,12 @@ const authRoute: FastifyPluginAsync = async (fastify) => {
       );
 
       // Also set token as HttpOnly cookie so subsequent API calls authenticate reliably
+      // Cross-site admin (gallus-pub.ch) -> backend (cms.gallus-pub.ch) requires SameSite=None & Secure in production
       reply.setCookie('token', token, {
         path: '/',
         httpOnly: true,
-        sameSite: 'lax',
-        secure: !!env.FRONTEND_URL && env.FRONTEND_URL.startsWith('https'),
+        sameSite: (env.NODE_ENV === 'production' ? 'none' : 'lax'),
+        secure: (env.NODE_ENV === 'production') || (!!env.FRONTEND_URL && env.FRONTEND_URL.startsWith('https')),
         maxAge: 60 * 60 * 24, // 24h
       });