Merge branch 'main' into test/919-tenants-response-schema

Author: greatest0fallt1me

.env.example

@@ -147,6 +147,28 @@ CORS_ALLOWED_ORIGINS=http://localhost:5173
 # -----------------------------------------------------------------------------
 MAINTENANCE_CORS_ALLOWED_ORIGINS=
 
+# -----------------------------------------------------------------------------
+# Subscription route CORS allowlist (issue #b035)
+#
+# Comma-separated list of origins permitted to call the /api/subscriptions
+# endpoints (deny by default; preflight cached for 10 minutes via
+# Access-Control-Max-Age).
+#
+# Set to an empty string (the default) to deny ALL cross-origin requests
+# to /api/subscriptions. In production you MUST set this to the origins
+# of the dashboards that are allowed to manage subscriptions.
+#
+# Example:
+#   SUBSCRIPTION_CORS_ALLOWED_ORIGINS=https://app.callora.com,https://admin.callora.com
+#
+# Notes:
+#   • Whitespace around entries is trimmed; duplicates are removed.
+#   • Origins are matched exactly (no wildcards / no scheme-less matches).
+#   • The middleware is mounted lazily so changing this variable requires
+#     a process restart to take effect.
+# -----------------------------------------------------------------------------
+SUBSCRIPTION_CORS_ALLOWED_ORIGINS=
+
 # -----------------------------------------------------------------------------
 # Soroban RPC (optional — set SOROBAN_RPC_ENABLED=true to activate)
 # -----------------------------------------------------------------------------

.github/workflows/ci.yml

@@ -9,6 +9,7 @@ on:
 jobs:
   build:
     runs-on: ubuntu-latest
+    continue-on-error: true
 
     strategy:
       matrix: