Cookies on Tunnel Domains: Why Login Works on localhost but Breaks on a Tunnel URL

You build a login flow, test it on localhost:3000, and it works. Then you expose the app through a tunnel to demo it, test OAuth, or open it on a phone. The login form submits, the server returns 200,