fix(oauth): cross-origin session cookies + redirect_uri + authlib import fix

.gitignore

@@ -1,44 +1,62 @@
-# Python
+# --- Python ---
 __pycache__/
 *.py[cod]
+*$py.class
+*.so
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
 *.egg-info/
-.venv/
-venv/
+.installed.cfg
+*.egg
 
-# Env / secrets
+# --- Virtual environments ---
+venv/
+.venv/
+env/
 .env
-.env.*
-!.env.example
-credentials.json
-*.key
 
-# Editor / OS
-.DS_Store
-.idea/
+# --- IDE ---
 .vscode/
+.idea/
+*.swp
+*.swo
+*~
 
-# Build
-__pycache__/
-*.so
-*.log
-.pytest_cache/
-build/
+# --- OS ---
+.DS_Store
+Thumbs.db
 
-# Local data / uploads
-uploads/
-data/
-*.pdf
-*.eml
-# Keep the demo/test fixture (the report + run_agent_demo.py depend on it)
-!tests/sample_feedback.eml
+# --- Testing ---
+.pytest_cache/
+.coverage
+htmlcov/
+.tox/
+.nox/
 
-# Hermes local planning state (plans, project cache) — not submission code
-.hermes/
+# --- mypy ---
+.mypy_cache/
+.dmypy.json
+dmypy.json
 
-# Hermes kanban task worktrees (Hermes-internal, not submission code)
-.worktrees/
+# --- Frontend ---
+frontend/.next/
+frontend/node_modules/
+frontend/.vercel/
 
-# Reference vendor repos (kept out of the submission)
-references/
+# --- Secrets (NEVER commit these) ---
+*.key.json
+sa-key.json
+*.pem
+*.p12
 .sa-key.json
-*.sa-key.json