refactor: update API base URL handling to support same-origin requests and enhance auth cookie management

apps/dashboard/src/lib/utils/services/auth/client.ts

@@ -1,9 +1,12 @@
 import { createAuthClient } from 'better-auth/svelte';
-import { env } from '$env/dynamic/public';
+import { getRequestBaseUrl } from '$lib/utils/services/api';
 import { ssoClient } from '@better-auth/sso/client';
 
+// Server: PRIVATE_SERVER_URL (Render internal). Browser: same-origin /api
+// through the Cloudflare Worker proxy, so auth cookies stay host-only on
+// whichever domain the user is on (app, tenant subdomain, or BYOD).
 export const authClient = createAuthClient({
-  baseURL: env.PUBLIC_SERVER_URL,
+  baseURL: getRequestBaseUrl(),
   fetchOptions: {
     credentials: 'include' // Include cookies in requests
   },