Set APP_URL to production HTTPS URL, force URL scheme and trust proxy headers in production to prevent mixed content errors. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>