fix(api): allow the admin console origin through CORS

The production allowlist held only https://sauci.app, so every
/v1/admin/* preflight from https://manage.sauci.app returned 204 with no
Access-Control-Allow-Origin and the browser blocked the request. Login
then reported "Access denied. You are not an administrator." because the
admin app treats any /v1/admin/me failure as a permissions failure.

Add the admin console origin and record in the README that new admin
hosts belong in the Compose contract rather than a Dokploy override.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

.dockerignore

@@ -39,3 +39,11 @@ terraform
 .claude
 .codex
 .ralph
+
+# The admin app builds from this same monorepo context (apps/admin/Dockerfile).
+!apps/admin
+!apps/admin/**
+
+# Host build artefacts must never leak into any image context.
+**/node_modules
+**/dist

.github/workflows/verify.yml

@@ -24,9 +24,14 @@ jobs:
             echo "master is frozen; target staging or main" >&2
             exit 1
           fi
-          if [ "$BASE_BRANCH" = "main" ] && [ "$HEAD_BRANCH" != "staging" ]; then
-            echo "Only staging may be promoted to main" >&2
+          if [ "$BASE_BRANCH" = "main" ]; then
+            case "$HEAD_BRANCH" in
+              staging|hotfix/*|release/*) ;;
+              *)
+                echo "main takes staging promotions, or a hotfix/* or release/* branch for direct work" >&2
                 exit 1
+                ;;
+            esac
           fi
           if [ "$BASE_BRANCH" != "staging" ] && [ "$BASE_BRANCH" != "main" ]; then
             echo "Feature pull requests target staging; promotions target main" >&2

docs/operations/backend-deployments.md

@@ -14,10 +14,14 @@ not deploy the retired Supabase data plane.
 | `master` | frozen legacy default | none | none |
 
 Normal feature pull requests target `staging`. After CI and authenticated staging
-acceptance pass, open a promotion pull request from `staging` to `main`. Do not
-add production-only commits to `main`: production should run the exact commit
-already exercised in staging. Direct pushes to either deployment branch are for
-explicit incident recovery only.
+acceptance pass, open a promotion pull request from `staging` to `main`. Prefer
+that route: production then runs the exact commit already exercised in staging.
+
+When production needs a change that cannot wait for the next promotion, open a
+pull request into `main` from a `hotfix/*` or `release/*` branch. CI enforces
+that naming so a direct-to-main change is always deliberate and visible. Land
+the same commit on `staging` too, or the next promotion will revert it. Direct
+pushes to either deployment branch remain blocked by branch protection.
 
 Each Dokploy Compose application is connected to `jjbrunton/Sauci`, watches its
 single branch with push-triggered automatic deployment, and uses

infra/backend/README.md

@@ -87,9 +87,12 @@ Before the first deployment, provide:
 5. A rollback and restore point before any migrated production data is imported.
 6. A separately generated `MEDIA_SIGNING_SECRET` (at least 32 characters) and
    the HTTPS API origin as `MEDIA_PUBLIC_BASE_URL`.
-7. The public web origin is fixed to `https://sauci.app` by
-   `CORS_ALLOWED_ORIGINS` in the Compose contract. Do not broaden it without a
-   reviewed browser client requirement.
+7. Browser origins are fixed by `CORS_ALLOWED_ORIGINS` in the Compose contract:
+   `https://sauci.app` (public web) and `https://manage.sauci.app` (admin
+   console, which calls `/v1/admin/*` with a bearer token). Do not broaden the
+   list without a reviewed browser client requirement, and add any new admin
+   host here rather than as a Dokploy override, so the allowlist stays
+   reviewable in git.
 8. A non-production hosted Auth project and disposable, onboarding-complete test
    identities mapped into the staging database for authenticated mobile acceptance.
 

infra/backend/compose.production.yaml

@@ -8,7 +8,8 @@ x-common-environment: &common-environment
 x-api-environment: &api-environment
   <<: *common-environment
   PORT: 3003
-  CORS_ALLOWED_ORIGINS: https://sauci.app
+  # https://manage.sauci.app is the admin console; it calls /v1/admin/* from the browser.
+  CORS_ALLOWED_ORIGINS: https://sauci.app,https://manage.sauci.app
   DATABASE_POOL_MAX: ${API_DATABASE_POOL_MAX:-10}
   DATABASE_POOL_IDLE_TIMEOUT_MS: ${DATABASE_POOL_IDLE_TIMEOUT_MS:-30000}
   DATABASE_POOL_CONNECTION_TIMEOUT_MS: ${DATABASE_POOL_CONNECTION_TIMEOUT_MS:-10000}