multiple verifications

.env.example

@@ -22,7 +22,14 @@ AUTH_SECRET="dev-secret-do-not-use-in-production-please-change-me"
 # must consciously opt in by editing their .env. See README "Auth" section.
 AUTH_DEV_AUTOLOGIN="false"
 
-# Base URL of the operator-pwa app — used by Auth.js for callback URLs.
+# Base URL Auth.js uses to build callback/redirect URLs. It MUST match the host
+# of the app being served. This shared .env can hold only ONE value, set here to
+# the operator-pwa (:3000). The admin-web (:3001) therefore needs its OWN
+# AUTH_URL whenever autologin is OFF (real-login dev, or production) — otherwise
+# Auth.js redirects admin users to :3000 and the admin login breaks.
+#   - Local with autologin ON: this value is harmless (middleware never redirects).
+#   - E2E real-login: e2e/playwright.auth.config.ts passes AUTH_URL=:3001 to admin.
+#   - Production: give EACH app its own AUTH_URL (per-app env), not this shared file.
 NEXT_PUBLIC_APP_URL="http://localhost:3000"
 AUTH_URL="http://localhost:3000"