localhost {
	# WebSockets bypass directly to backend (workaround for bun proxy bug)
	# Avoids bug https://github.com/oven-sh/bun/issues/9882
	handle /auth/ws/* {
		reverse_proxy :4402   # directly to backend
	}
	# Everything else goes to or via Vite
	# (Vite proxies /auth/api, /.well-known/openid-configuration and
	# /.well-known/webauthn to the backend)
	handle {
		reverse_proxy :4403   # vite dev server
	}
}