Added backoffice, hackathon, qr, and infra subdomains to the default CORS_ALLOWED_ORIGINS. Previously only gacha, imphnen.dev, and dimentorin were allowed, causing Network Error on other apps. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>