Why does the browser see requests made from one localhost subdomain to another on the same domain as `sec-fetch-site:cross-site`? - fetch-metadata

Question

I have a dockerised local dev env for an SPA. The setup is that there are front-end and back-end subdomains on localhost, running over https.
I.e.:
fe.localhost
be.localhost
(These are the actual domains I'm using; they are not placeholders nor obfuscated examples.)
According to the MDN docs (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Sec-Fetch-Site#directives) -
same-site
The request initiator and the server hosting the resource have the same scheme, domain and/or subdomain, but not necessarily the same port.
Why then are requests from the front-end to the back-end being reported by the browser as cross-site?
This happens when e.g. my front-end (which is browsable on https://fe.localhost makes a GET or POST request to the back-end on https://be.localhost/api/people/login.
Here's the full server code:
<?php
include('debugTools.php');
global $data;
$data = [];
function loggedOut() {
header('Content-Type: application/json; charset=utf-8');
return [
'login' => [
'valid' => false,
'message' => 'Not currently logged in.'
]
];
}
function login() {
header('Content-Type: application/json; charset=utf-8');
header('Access-Control-Allow-Headers: X-Requested-With, Content-Type');
session_start();
return [
'login' => [
'valid' => true,
]
];
}
function loggedIn() {
header('Content-Type: application/json; charset=utf-8');
return [
'login' => [
'valid' => true,
]
];
}
$path = $_SERVER['REQUEST_URI'];
$method = $_SERVER['REQUEST_METHOD'];
switch($method) {
case 'POST':
switch ($path) {
case '/api/people/login':
$data = login();
break;
}
break;
default: // GET
switch ($path) {
case '/api/people/login':
if(session_id()) {
$data = loggedIn();
} else {
$data = loggedOut();
}
break;
}
break;
}
echo json_encode($data);