5efb433c23
Root cause: INTERNAL_SECRET was on same line as HOST= in .env (no trailing newline when appended), so proxy middleware got empty secret and rejected all /api/internal/validate-* calls → rewrote every /client/* request to /not-found without running the page component.