work-preview-on-phonelisted

# Preview this project on the phone **Why this exists:** the three things that break are invisible in the browser and each one looks like one of the others. The page renders and nothing is clickable. Login fails with an error naming a URL. A fix that worked reads as broken because the phone cached the old page. Each has a one-line cause and none of them announce themselves. **DO use `tailscale serve`. DON'T use `tailscale funnel`.** Serve routes "traffic from other devices on your Tailscale network"; Funnel is "publicly available" and drops the identity headers ([Tailscale docs](https://tailscale.com/kb/1312/serve)). A dev server holds real credentials, real data and no rate limiting, so Funnel puts all of it on the internet. This skill is Tailscale-only for that reason — a public tunnel (zrok `share public`, ngrok) hits the identical three traps below AND exposes the box. ## Step 1 · Bind the dev server to loopback, THEN serve it **DO bind the dev server to `127.0.0.1` before sharing it.** Most dev servers bind every interface by default, which puts a box holding real credentials, real data and no rate limiting on whatever network the machine is on — a café or co-working Wi-Fi is every device on that Wi-Fi. Tailscale Serve proxies from the machine's OWN loopback, so binding to loopback costs nothing and closes the LAN completely. ```bash npm run dev -- -H 127.0.0.1 # Next; Vite: --host 127.0.0.1 ``` TEST: `lsof -nP -iTCP:<port> -sTCP:LISTEN` shows `127.0.0.1:<port