Without the leading dot, the auth_token cookie was only sent to the
exact host homelab.local — not to finance.homelab.local, auth.homelab.local,
etc. — so the forward-auth check failed on any subdomain after login.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>