Kaj SchittecatandClaude Opus 5
baf2e6c0cc
nginx and the service were both adding Access-Control-Allow-Origin to the matrix response. Two of them is not a stronger permission: the CORS check fails on a duplicate and the browser rejects the response, so wadamesh.com/beta could not read firmware.wadamesh.com at all. Only the service sets it now, verified from the live origin. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>