Replace password-based /api/user/login bridge after external auth with POST /api/user/session/from-agnet: verify access (and optional refresh) against Agnet /api/auth/me, upsert local user by email, then issue the Manager session cookie. Frontend sends bearer tokens only. Includes HEICODE_AUTH_BASE_URL in compose defaults and .env.example. Made-with: Cursor