feat(auth): add login audience middleware (EDRFREIGHT-415)

apps/edr-freight-web/backoffice/src/shared/services/axiosInstance.ts

@@ -25,6 +25,9 @@ axiosInstance.interceptors.request.use((config) => {
   }
   // X-Requested-With prevents CSRF via browser-native form/fetch without custom headers
   config.headers["X-Requested-With"] = "XMLHttpRequest";
+  // Tells the backend which app is asking, so /auth/login can reject
+  // cross-audience credentials (EDRFREIGHT-415).
+  config.headers["X-Client-App"] = "backoffice";
   return config;
 });