AUTH_BASE_URL, FRONTEND_URL, INTERNAL_API_KEY, SESSION_SECRET,
COOKIE_SECURE, COOKIE_DOMAIN, REFRESH_COOKIE_NAME were in .env
but not passed to auth container. OAuth callbacks were using
localhost:8001 instead of the public URL.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>