fix(api): allow the admin console origin through CORS

The production allowlist held only https://sauci.app, so every
/v1/admin/* preflight from https://manage.sauci.app returned 204 with no
Access-Control-Allow-Origin and the browser blocked the request. Login
then reported "Access denied. You are not an administrator." because the
admin app treats any /v1/admin/me failure as a permissions failure.

Add the admin console origin and record in the README that new admin
hosts belong in the Compose contract rather than a Dokploy override.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

infra/backend/README.md

@@ -87,9 +87,12 @@ Before the first deployment, provide:
 5. A rollback and restore point before any migrated production data is imported.
 6. A separately generated `MEDIA_SIGNING_SECRET` (at least 32 characters) and
    the HTTPS API origin as `MEDIA_PUBLIC_BASE_URL`.
-7. The public web origin is fixed to `https://sauci.app` by
-   `CORS_ALLOWED_ORIGINS` in the Compose contract. Do not broaden it without a
-   reviewed browser client requirement.
+7. Browser origins are fixed by `CORS_ALLOWED_ORIGINS` in the Compose contract:
+   `https://sauci.app` (public web) and `https://manage.sauci.app` (admin
+   console, which calls `/v1/admin/*` with a bearer token). Do not broaden the
+   list without a reviewed browser client requirement, and add any new admin
+   host here rather than as a Dokploy override, so the allowlist stays
+   reviewable in git.
 8. A non-production hosted Auth project and disposable, onboarding-complete test
    identities mapped into the staging database for authenticated mobile acceptance.
 

infra/backend/compose.production.yaml

@@ -8,7 +8,8 @@ x-common-environment: &common-environment
 x-api-environment: &api-environment
   <<: *common-environment
   PORT: 3003
-  CORS_ALLOWED_ORIGINS: https://sauci.app
+  # https://manage.sauci.app is the admin console; it calls /v1/admin/* from the browser.
+  CORS_ALLOWED_ORIGINS: https://sauci.app,https://manage.sauci.app
   DATABASE_POOL_MAX: ${API_DATABASE_POOL_MAX:-10}
   DATABASE_POOL_IDLE_TIMEOUT_MS: ${DATABASE_POOL_IDLE_TIMEOUT_MS:-30000}
   DATABASE_POOL_CONNECTION_TIMEOUT_MS: ${DATABASE_POOL_CONNECTION_TIMEOUT_MS:-10000}