CORS: allow all origins for production

app/main.py

@@ -26,10 +26,10 @@ app = FastAPI(
     openapi_url="/openapi.json",
 )
 
-# CORS — mirrors PHP cors.php allowed origins
+# CORS — allow any origin so production, staging, and local all work
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=settings.cors_origins_list,
+    allow_origins=["*"],
     allow_credentials=False,
     allow_methods=["GET", "POST", "OPTIONS"],
     allow_headers=["*"],