CORS Policy
Allowed origins are environment-aware in `app.js`. Production explicitly allows zitrabot domains while local mode allows localhost origins.
Backend Documentation
Deployment
Production considerations for CORS, sessions, cookies, static assets, and process lifecycle.
Session Cookies
Cookie security toggles by `NODE_ENV`: secure and `sameSite=none` in production, lax behavior in development.
Static Assets
`/standalone` static mount applies custom headers, CORS allowances, and cache control in production.
Port and Runtime
Backend listens on `PORT` or defaults to `5000`. Ensure process manager restarts on crash and handles zero-downtime rollout.