fix: allow CORS preflight OPTIONS requests in guarded routes

Dockerfile

@@ -41,7 +41,7 @@ EXPOSE 7860
 ENV PORT=7860
 
 # Force Docker cache invalidation - bump date to trigger clean rebuild
-ENV REBUILD_DATE="2026-04-22-v15-multi-tenant-final"
+ENV REBUILD_DATE="2026-04-22-v16-cors-preflight-fix"
 
 # SAFETY: Default to skipping DB push to prevent schema drift.
 # Only Railway (api service) should push schema — it overrides SKIP_DB_PUSH=false in its variables.

apps/api/src/index.ts

@@ -82,6 +82,9 @@ server.register(stripeWebhookRoute, { prefix: '/v1/payments' });
 // ── Private Routes (require ADMIN_API_KEY) ─────────────────────────────────────
 server.register(async function guardedRoutes(scope) {
     scope.addHook('onRequest', async (request, reply) => {
+        // 🚨 CORS FIX: Skip authentication for preflight OPTIONS requests
+        if (request.method === 'OPTIONS') return;
+
         const apiKey = process.env.ADMIN_API_KEY;
 
         if (!apiKey) {