fix(api): support shared session cookie domain

apps/dashboard/src/lib/api.test.ts

@@ -39,7 +39,7 @@ describe('dashboard apiFetch', () => {
     }))
   })
 
-  it('keeps browser requests on the dashboard proxy even when a public API origin is configured', async () => {
+  it('normalizes a public API origin to the versioned API base', async () => {
     installBrowser()
     process.env.NEXT_PUBLIC_API_URL = 'https://api.rentaldrivego.ma'
     const fetchMock = vi.fn(async () => ({
@@ -51,7 +51,7 @@ describe('dashboard apiFetch', () => {
     const { apiFetch } = await import('./api')
     await apiFetch('/auth/account/start', { method: 'POST', body: JSON.stringify({}) })
 
-    expect(fetchMock).toHaveBeenCalledWith('/dashboard/api/v1/auth/account/start', expect.any(Object))
+    expect(fetchMock).toHaveBeenCalledWith('https://api.rentaldrivego.ma/api/v1/auth/account/start', expect.any(Object))
   })
 
   it('does not force JSON content type for FormData payloads', async () => {

apps/dashboard/src/lib/api.ts

@@ -6,7 +6,7 @@ function normalizeApiBase(value: string): string {
 export const API_BASE = normalizeApiBase(
   typeof window === 'undefined'
     ? (process.env.API_INTERNAL_URL || 'http://localhost:4000/api/v1')
-    : '/dashboard/api/v1',
+    : (process.env.NEXT_PUBLIC_API_URL || '/dashboard/api/v1'),
 )
 
 export const EMPLOYEE_PROFILE_KEY = 'employee_profile'