fix: CORS allow all cloud domains for multi-network white-label

The CORSMiddleware was initialized with only bootnode.dev origin.
Added all cloud.*.network domains and ALLOWED_ORIGINS env var
for extending origins without code changes.

api/bootnode/config.py

@@ -46,6 +46,7 @@ class Settings(BaseSettings):
     enable_multi_tenant: bool = True
     allowed_orgs: list[str] = ["hanzo", "zoo", "lux", "pars"]
     frontend_url: str = "http://localhost:3001"
+    allowed_origins: list[str] = []  # Extra CORS origins (comma-separated in env)
 
     # Rate Limiting
     rate_limit_requests: int = 100  # per minute
@@ -69,6 +70,7 @@ class Settings(BaseSettings):
     bsc_testnet_rpc: str = ""
     lux_mainnet_rpc: str = ""
     lux_testnet_rpc: str = ""
+    lux_devnet_rpc: str = ""
     solana_mainnet_rpc: str = ""
     solana_devnet_rpc: str = ""
     btc_mainnet_rpc: str = ""

api/bootnode/main.py

@@ -83,10 +83,29 @@ app = FastAPI(
     lifespan=lifespan,
 )
 
-# CORS
+# CORS - all cloud domains for white-label multi-network support
+production_origins = [
+    "https://bootno.de",
+    "https://cloud.lux.network",
+    "https://cloud.pars.network",
+    "https://cloud.zoo.network",
+    "https://cloud.hanzo.network",
+    "https://cloud.hanzo.ai",
+]
+# Add frontend_url if set
+if settings.frontend_url:
+    origin = settings.frontend_url.rstrip("/")
+    if origin not in production_origins:
+        production_origins.append(origin)
+# Add extra origins from ALLOWED_ORIGINS env var
+for extra in settings.allowed_origins:
+    origin = extra.strip().rstrip("/")
+    if origin and origin not in production_origins:
+        production_origins.append(origin)
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"] if not settings.is_production else ["https://bootnode.dev"],
+    allow_origins=["*"] if not settings.is_production else production_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],