fix(bridge-server): allow every white-label tenant origin in CORS

The backend origin allow-list only permitted bridge.lux.network + *.lux.*,
so a swap POST from a tenant bridge (Zoo/Pars/Hanzo) — which carries an
Origin header even same-origin — was rejected (500). Add the explicit
tenant hosts (zoo.network, zoo.ngo, pars.network, hanzo.ai) alongside the
Lux regex. Networks (GET) already load same-origin via the ingress /api
route; this completes the swap path for the next bridge-server release.

Co-authored-by: Hanzo Dev <[email protected]>

app/server/src/server.ts

@@ -47,8 +47,19 @@ try {
   })
 
   // Middleware
+  // Per-brand allow-list. Every white-labeled bridge tenant may call this
+  // backend cross-origin (tenant UIs also route /api same-origin via ingress,
+  // but swap POSTs carry an Origin header, so the tenant host must be allowed).
+  // The `*.lux.(network|exchange)` regex keeps every Lux subdomain (wallet, etc.).
   app.use(cors({
-    origin: ['https://bridge.lux.network', /\.lux\.(network|exchange)$/],
+    origin: [
+      'https://bridge.lux.network',
+      'https://bridge.zoo.network',
+      'https://bridge.zoo.ngo',
+      'https://bridge.pars.network',
+      'https://bridge.hanzo.ai',
+      /\.lux\.(network|exchange)$/,
+    ],
   }))
   app.use(rateLimit({
     windowMs: 15 * 60 * 1000, // 15 minutes