Browsers (Safari, Brave, Firefox, increasingly Chrome) refuse to set or
send SameSite=None cookies cross-site. With the frontend on
openswe.vercel.app and the API on *.langgraph.app, the osw_session
cookie from `/auth/callback` was being silently dropped, so every
subsequent /me call returned 401.
Adding a Vercel rewrite makes the API same-origin from the browser's
point of view: the request goes to openswe.vercel.app/dashboard/api/...,
Vercel proxies it to the LangSmith deployment, and the Set-Cookie comes
back attributed to openswe.vercel.app — a first-party cookie that all
browsers honour.
Pair with the matching deployment-side config changes:
- GitHub App callback URL → https://openswe.vercel.app/dashboard/api/auth/callback
- DASHBOARD_API_BASE_URL → https://openswe.vercel.app (LangSmith env)
- VITE_DASHBOARD_API_BASE_URL → unset / empty (Vercel env)
