fix

apps/api/internal/httpapi/middleware.go

@@ -232,6 +232,9 @@ func (s *Server) CSRF(next http.Handler) http.Handler {
 				MaxAge:   7 * 24 * 60 * 60,
 			})
 		}
+		// Expose for cross-origin SPAs (api.* vs app host): document.cookie cannot
+		// read host-only API cookies; the client seeds via GET and mirrors this header.
+		w.Header().Set("X-CSRF-Token", token)
 
 		if r.Method == http.MethodGet || r.Method == http.MethodHead || r.Method == http.MethodOptions {
 			next.ServeHTTP(w, r)