Register the endpoints list without a trailing slash, and stop hiding its errors

.env.example

@@ -36,6 +36,18 @@ DATABASE_URL=mysql+pymysql://shopdb:CHANGE_ME@db:3306/shopdb_flask?charset=utf8m
 # Wildcard '*' is rejected by ProductionConfig.validate().
 CORS_ORIGINS=http://localhost:5173
 
+# ---- Reverse proxy (optional, default 0 = no proxy) ----
+# Set to the number of proxies actually in front of this instance - 1 when IIS
+# or nginx serves it under a subpath such as /shopdb. Without it the app sees
+# the proxy's connection instead of the browser's (scheme http, the proxy's
+# host and IP), so any absolute URL it builds is wrong at the browser. That is
+# what made a redirect on the endpoints list unfollowable behind IIS.
+#
+# Leave it at 0 when nothing fronts the app. It makes X-Forwarded-* trusted,
+# and a client can send those headers itself - the login rate limit and the
+# account lockout are keyed on the client address.
+TRUSTED_PROXY_COUNT=0
+
 # ---- JWT lifecycle (optional, defaults shown) ----
 JWT_ACCESS_TOKEN_EXPIRES=3600
 JWT_REFRESH_TOKEN_EXPIRES=2592000