- Disable Vite built-in CORS (sets wildcard * which fails with credentials) - Add custom CORS middleware that echoes request origin - Handle OPTIONS preflight explicitly - Proxy uses changeOrigin: false to preserve request origin - API's trusted origin detection handles Tailscale IPs