fix(auth): 修復遠端部署登入失敗問題 v0.1.7

## Bug Fixes
- Cookie sameSite 從 strict 改為 lax（修復遠端存取問題）
- 新增 Cookie path 設定確保覆蓋整個應用
- 新增 TRUST_PROXY 環境變數支援 reverse proxy

## Features
- Dockerfile 新增 texlive-lang-arabic/other（阿拉伯/希伯來語）
- Dockerfile 新增 python3-opencv（電腦視覺）
- Dockerfile 新增 libavcodec-extra（額外編解碼器）
- Locale 預設改為 zh_TW.UTF-8
- Pandoc PDF 引擎改用 pdflatex

## Docs
- compose.yaml 新增 TRUST_PROXY 說明
- 新增遠端部署注意事項

src/helpers/env.ts

@@ -3,6 +3,9 @@ export const ACCOUNT_REGISTRATION = process.env.ACCOUNT_REGISTRATION?.toLowerCas
 
 export const HTTP_ALLOWED = process.env.HTTP_ALLOWED?.toLowerCase() === "true" || false;
 
+// Trust proxy headers (X-Forwarded-*) for correct HTTPS detection behind reverse proxy
+export const TRUST_PROXY = process.env.TRUST_PROXY?.toLowerCase() === "true" || false;
+
 export const ALLOW_UNAUTHENTICATED =
   process.env.ALLOW_UNAUTHENTICATED?.toLowerCase() === "true" || false;
 

src/pages/user.tsx

@@ -10,12 +10,31 @@ import {
   ALLOW_UNAUTHENTICATED,
   HIDE_HISTORY,
   HTTP_ALLOWED,
+  TRUST_PROXY,
   WEBROOT,
 } from "../helpers/env";
 import { localeService } from "../i18n/service";
 
 export let FIRST_RUN = db.query("SELECT * FROM users").get() === null || false;
 
+// ==============================================================================
+// Cookie 設定輔助函數
+// ==============================================================================
+// 解決遠端部署時登入失敗的問題：
+// 1. sameSite: "lax" - 允許導航時傳送 Cookie（strict 會阻擋）
+// 2. path: WEBROOT || "/" - 確保 Cookie 覆蓋整個應用
+// 3. secure: 考慮 TRUST_PROXY 設定
+// ==============================================================================
+function getCookieOptions() {
+  return {
+    httpOnly: true,
+    secure: !HTTP_ALLOWED && !TRUST_PROXY ? true : false,
+    maxAge: 60 * 60 * 24 * 7, // 7 days
+    sameSite: "lax" as const,
+    path: WEBROOT || "/",
+  };
+}
+
 export const userService = new Elysia({ name: "user/service" })
   .use(
     jwt({
@@ -224,13 +243,10 @@ export const user = new Elysia()
         };
       }
 
-      // set cookie
+      // set cookie with proper options for remote deployment
       auth.set({
         value: accessToken,
-        httpOnly: true,
-        secure: !HTTP_ALLOWED,
-        maxAge: 60 * 60 * 24 * 7,
-        sameSite: "strict",
+        ...getCookieOptions(),
       });
 
       return redirect(`${WEBROOT}/`, 302);
@@ -353,13 +369,10 @@ export const user = new Elysia()
         };
       }
 
-      // set cookie
+      // set cookie with proper options for remote deployment
       auth.set({
         value: accessToken,
-        httpOnly: true,
-        secure: !HTTP_ALLOWED,
-        maxAge: 60 * 60 * 24 * 7,
-        sameSite: "strict",
+        ...getCookieOptions(),
       });
 
       return redirect(`${WEBROOT}/`, 302);