fix(deploy): ADMIN_ORIGIN must list the marketing site too

/start now posts account signups straight to admin, so the browser sends
a cross-origin preflight from vantage.hostxtra.co.uk. With only the
console origin in ADMIN_ORIGIN it was refused.

The failure mode is worth naming: cors() omits Access-Control-Allow-Origin
but still answers the preflight 204, so the browser blocks the request and
admin logs nothing. It looks like the endpoint is down when curl says it
is fine.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/docker-compose.site.yml

@@ -42,6 +42,12 @@ services:
             REDIS_PASSWORD: ${REDIS_PASSWORD:-}
             LICENSE_SIGNING_KEY: ${LICENSE_SIGNING_KEY:-}
             PUBLIC_URL: ${ADMIN_PUBLIC_URL:-}
+            # Comma-separated, and it needs BOTH browser origins that call admin:
+            # vantage-hq (the console) and the marketing site, whose /start form
+            # posts account signups here. An origin missing from this list is not
+            # a 403 — admin omits the CORS header entirely and the browser blocks
+            # the preflight, so the form fails with nothing in admin's logs.
+            #   ADMIN_ORIGIN="https://vantage-hq.hostxtra.co.uk,https://vantage.hostxtra.co.uk"
             ADMIN_ORIGIN: ${ADMIN_ORIGIN:-}
             TRUST_PROXY: ${TRUST_PROXY:-true}
             SMTP_HOST: ${SMTP_HOST:-}