sync build tree from private myoffice

MyOffice.SPA/src/app/config.oidc.ts

@@ -23,7 +23,8 @@ function resolveAllowedUrls(): string[] {
 	}
 	const origin = publicOrigin();
 	const api = (environment.apiUrl ?? '').trim().replace(/\/$/, '');
-	return api ? [origin, api] : [origin];
+	// Relative ApiRoutes (`/api/...`) need '/api' in allowedUrls or the Bearer is never sent.
+	return api ? [origin, api, '/api'] : [origin, '/api'];
 }
 
 export const AuthCodeFlowConfig: AuthConfig = {

MyOffice.SPA/src/environments/environment.proxmox.ts

@@ -1,11 +1,12 @@
 // Same-origin Proxmox deploy: API serves SPA from wwwroot (one public URL).
-// Empty apiUrl / identityServer / allowedUrls → resolved at runtime from window.location.origin.
+// Empty apiUrl / identityServer → resolved at runtime from window.location.origin.
+// allowedUrls '/api' so angular-oauth2-oidc attaches Bearer to relative /api/... calls.
 export const environment = {
 	production: true,
 	apiUrl: '',
 	identityServer: '',
-	allowedUrls: [] as string[],
-	requireHttps: false,
+	allowedUrls: ['/api'] as string[],
+	requireHttps: true,
 	externalLogins: {
 		google: {
 			clientId: ''