Mis-scoped Cookies and Messages

Backend-set cookies and locale-based message bundles silently mismatch their expected scope, so browsers fail to send cookies across subdomains and Spring fails to resolve message keys for Swagger or UI.