修复本地详情验证刷新会话（05-31-unify-business-detail-ant-design）

.trellis/spec/hyb-oa/frontend-react-vite-design.md

@@ -29,6 +29,11 @@ and verification contracts. Do not copy broad aesthetic guidance from
   safe-area and sticky action patterns unless the current task intentionally
   redesigns them with `frontend-design`.
 - Do not add decorative landing-page styling to operational OA pages.
+- The local Vite `/api` proxy must preserve the browser-facing Host when
+  running Playwright against `127.0.0.1:5173`; backend auth refresh validates
+  `Origin`/`Referer` against the request host when `APP_ORIGIN` is not set.
+  Rewriting Host to `127.0.0.1:3000` makes full-page reloads lose the session
+  with `AUTH_005`.
 - Run `cd client && npm run typecheck && npm run build` for frontend changes.
 
 ## Convention: Mature Enterprise Page Baseline

.trellis/tasks/05-31-unify-business-detail-ant-design/implement.md

@@ -28,8 +28,9 @@ This task implements the first reusable PC business detail slice:
 * `workflow-action-confirm-ui.spec.ts` passed.
 * `pc-detail-mobile-visual-wave3.spec.ts -g "Wave3 PC"` passed and screenshot
   review confirmed the approval action area no longer renders an empty divider.
-* `assets-flow.spec.ts` was rerun with local backend started. It passed login
-  and asset creation, then local auth refresh returned `401` after a full
-  `page.goto(/assets?id=...)`, redirecting to `/login`. This is recorded as a
-  local authentication-refresh/test-environment blocker, not a detail-template
-  regression.
+* `assets-flow.spec.ts` initially passed login and asset creation, then local
+  auth refresh returned `401` after a full `page.goto(/assets?id=...)`.
+  Investigation showed Vite's local proxy rewrote Host to `127.0.0.1:3000`
+  while the browser `Referer` stayed on `127.0.0.1:5173`, so backend origin
+  verification rejected refresh. Preserving the original Host in Vite proxy
+  fixed the local flow; the focused asset E2E then passed.

.trellis/tasks/05-31-unify-business-detail-ant-design/prd.md

@@ -47,7 +47,7 @@
 * [x] 资产详情页使用统一右侧操作面板，保存/创建是主操作，流转动作在同一操作区内有清晰分组。
 * [x] 资产摘要不再作为独立局部风格卡片堆在操作区下方，而是进入统一事实/摘要结构。
 * [x] 审批详情页保持横向一条动作栏，不出现多个竖向主操作卡片。
-* [ ] 既有资产流转、保存和审批动作测试仍通过。审批动作已通过；资产主链路在本地后端重跑时通过登录和创建，随后因本地 auth refresh `401` 重定向登录，未进入详情断言。
+* [x] 既有资产流转、保存和审批动作测试仍通过。
 * [x] 设计规范记录详情模板组件契约和首批适用范围。
 
 ## Test Plan
@@ -74,7 +74,7 @@
 * `cd client && npm run build` passed.
 * `workflow-action-confirm-ui.spec.ts` passed.
 * `pc-detail-mobile-visual-wave3.spec.ts -g "Wave3 PC"` passed; screenshot review confirmed the right-side approval action panel has one horizontal action bar and no empty divider.
-* `assets-flow.spec.ts` blocked by local auth refresh after a full page reload: the test passed login and `POST /api/assets`, then `/api/auth/refresh` returned `401` and the app redirected to `/login`.
+* `assets-flow.spec.ts` initially exposed a local Vite proxy auth-refresh blocker: the test passed login and `POST /api/assets`, then `/api/auth/refresh` returned `401` after full route reload. Root cause was Vite proxy rewriting Host to `127.0.0.1:3000` while the browser `Referer` stayed on `127.0.0.1:5173`; after preserving the original Host in Vite proxy, the focused asset flow passed.
 
 ## Out Of Scope
 

client/vite.config.ts

@@ -153,7 +153,7 @@ export default defineConfig({
     proxy: {
       "/api": {
         target: "http://127.0.0.1:3000",
-        changeOrigin: true,
+        changeOrigin: false,
       },
     },
   },