Reference creatortrack auth single host

CreatorTrack auth is single-host by design: AUTH_URL=https://app.creatortrack.ai pins the Google OAuth callback there, so PKCE/state cookies must be set on that host. The apex creatortrack.ai is marketing-only (/landing, /product, /pricing, /brand, root rewrite); proxy.ts 308-redirects every other apex path (including /login, /signup, /api/auth/*) to app.creatortrack.ai (commit d88237a, 2026-07-06, after prod Google login broke with InvalidCheck: pkceCodeVerifier value could not be parsed).

Never add app or auth surfaces back to the apex host without either moving them to the app host or registering a second redirect URI in the Google OAuth client AND dropping the fixed AUTH_URL. New marketing pages must be added to both PUBLIC_PATHS and the marketing list in proxy.ts.

Related: [[creatortrack-dev-testing]]

URL: https://mkdocs.justinsforge.com/memory/general/reference_creatortrack_auth_single_host/