fix: isolate Vercel deployments and document OAuth domain setup

.vercelignore

@@ -0,0 +1,28 @@
+# Keep local credentials and operator files out of every Vercel upload.
+.git/
+.vercel/
+.env*
+**/.env*
+**/*.env
+.neon
+.agents/
+.codex/
+skills-lock.json
+**/appsettings.Local.json
+**/*.user
+**/*.suo
+
+# Backend build output and local data are not deployment inputs.
+backend/**/bin/
+backend/**/obj/
+backend/**/.data/
+**/*.db
+**/*.db-shm
+**/*.db-wal
+
+# Dependencies and generated frontend/test output are rebuilt by Vercel.
+node_modules/
+.next/
+coverage/
+playwright-report/
+test-results/

docs/containers.md

@@ -147,9 +147,12 @@ build needs `global.json` and `shared/`. Its catch-all rewrite serves the API; t
 is for a **separate backend Vercel project**, not the existing Next.js project. Container Runtime
 and Services are currently beta features.
 
-1. In a separate checkout or worktree, link Vercel CLI to a dedicated backend project with
-   `vercel link`. Set that project's Root Directory to the repository root. A separate checkout
-   keeps its local `.vercel` project link apart from the frontend's link.
+1. Use a separate checkout or worktree for a dedicated backend project. Create the project
+   with `vercel project create procoderji-api --scope YOUR_TEAM` if it does not exist, then link
+   it explicitly with `vercel link --yes --project procoderji-api --scope YOUR_TEAM`. A plain
+   `vercel link` can select the frontend project from the Git remote. Set the backend project's
+   Root Directory to the repository root. A separate checkout keeps its local `.vercel` project
+   link apart from the frontend's link.
 2. Set these values in the backend project's environment settings:
 
    | Variable | Value |
@@ -171,20 +174,29 @@ and Services are currently beta features.
    docker run --rm --env Database__Provider --env ConnectionStrings__Platform --env Database__Name --env PublicOrigin procoderji-api:local --migrate
    ```
 
-4. Deploy using the optional configuration from the repository root:
+4. In the **backend-only checkout**, copy the optional configuration to `vercel.json` so the
+   remote build reads the service configuration, then deploy from the repository root. Preserve
+   any existing `vercel.json` before copying:
 
    ```bash
-   vercel deploy --local-config vercel.backend.json --prod
+   cp vercel.backend.json vercel.json
+   vercel deploy --project procoderji-api --scope YOUR_TEAM --prod
    ```
 
+   In PowerShell, use `Copy-Item vercel.backend.json vercel.json`. Keep this generated
+   `vercel.json` local to the backend checkout; committing its catch-all API rewrite to the
+   shared branch would change frontend deployments. Keep the repository's `.vercelignore` in
+   place: Git ignore rules alone do not exclude all local operator files from Vercel CLI uploads.
+
 5. Set the frontend project's server-only `DOTNET_API_URL` to the backend's reachable HTTPS
    origin, redeploy the frontend, and verify the callback and account flows. Deployment
    Protection must allow the frontend's server requests to reach the backend. The OAuth
    callback remains on the frontend origin; do not register the backend URL as the callback.
 
 The optional configuration is an operator template; no Vercel project is created or changed by
-committing it. It has not been verified against a live Vercel account. Review beta availability,
-project settings and database connectivity before using it for production accounts.
+committing it. Verify the deployed API's health, session endpoint, Google redirect and database
+connectivity before enabling frontend account traffic. A successful build alone does not
+establish that the container serves requests.
 
 The repository does not provision a cloud account, a database, DNS or Google credentials. A
 successful image build or CI check does not verify live Google consent in the deployed system.

docs/deployment.md

@@ -100,6 +100,14 @@ The intended production setup serves the canonical HTTPS origin directly and red
 hosts to that origin while preserving paths. Compare the final served host with canonical tags,
 Open Graph URLs, robots and sitemap entries.
 
+Configure this redirect before enabling Google sign-in. A login started on `www.procoderji.com`
+sets a host-only correlation cookie there; a callback to `procoderji.com` cannot receive that
+cookie. In the frontend Vercel project's Domains settings, redirect `www.procoderji.com` to
+`procoderji.com` with status `308`, preserving the path and query. Verify that even
+`https://www.procoderji.com/api/platform/auth/google` redirects to the canonical host before a
+correlation cookie is issued. Keep the Google callback and backend `PublicOrigin` on that same
+canonical origin. This changes hosting redirects, not DNS records.
+
 Read-only checks:
 
 ```bash