handleSessionCallback's redirects (success and all 4 failure branches) were relative paths, which resolve against the backend's own origin -- broken in this project's own supported split-origin local dev setup, since the Go backend serves no "/" route at all. Now uses the new config.Config.FrontendURL (defaults to PublicBaseURL, so no change for single-origin production deployments). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>