You've described the cause in your own post without noticing. The dev proxy makes everything same-origin, so the cookie is first-party and the browser is relaxed about it. In production the frontend and the API are different sites, so that cookie is now a third-party cookie and the default SameSite=Lax means it is never attached to a cross-site XHR.
Minimum to make it work as-is:
SameSite=None; Secure on the cookie, and Secure means real HTTPS on both ends
credentials: 'include' on every fetch, it is not the default
Access-Control-Allow-Credentials: true on the API
Access-Control-Allow-Origin set to your exact frontend origin, because a wildcard is ignored when credentials are involved
Miss any one of those four and you get exactly your symptom, header present, cookie never sent.
The better fix, if you can, is to stop it being cross-site at all. Put the API behind the same hostname on a path, example.com/api, via a reverse proxy or your host's rewrites. Then everything is first-party, none of the above applies, and Safari's tracking prevention stops being your problem in six months.