Browser creates cookies keyed by the external hostname (sb-myeasycms-*), but server was using SUPABASE_INTERNAL_URL (sb-supabase-kong-*) — different keys = server can't find the session = infinite 'please wait' after login. Both client and server now use the same NEXT_PUBLIC_SUPABASE_URL (external domain). The SSR reaches Supabase via Traefik → Kong which works fine.