fix(admin): isolate login on admin host

Allow runtime request headers through API preflight and keep the storefront shell hidden while admin QR authentication gates backoffice.

scripts/deploy/configure-api-domain.sh

@@ -59,7 +59,7 @@ server {
     add_header Access-Control-Allow-Origin      \$cors_origin always;
     add_header Access-Control-Allow-Credentials "true" always;
     add_header Access-Control-Allow-Methods     "GET, POST, PUT, PATCH, DELETE, OPTIONS" always;
-    add_header Access-Control-Allow-Headers     "Authorization, Content-Type, AdminWebSessionID, X-Requested-With" always;
+    add_header Access-Control-Allow-Headers     "Authorization, Content-Type, AdminWebSessionID, WebSessionID, Currency, X-Language, X-Region, X-Requested-With" always;
     add_header Vary                             "Origin" always;
 
     if (\$request_method = OPTIONS) { return 204; }

src/app/app.html

@@ -10,6 +10,8 @@
     <p>{{ 'app.serverError' | translate }}</p>
     <button class="retry-btn" (click)="retryConnection()">{{ 'app.retryConnection' | translate }}</button>
   </div>
+} @else if (isAdminHost && !isAdminRoute()) {
+  <app-telegram-login mode="admin" />
 } @else if (isAdminRoute()) {
   <router-outlet></router-outlet>
   <app-telegram-login mode="admin" />

src/app/app.ts

@@ -28,6 +28,8 @@ import { TelegramLoginComponent } from './components/telegram-login/telegram-log
 })
 export class App implements OnInit {
   protected title = '';
+  readonly isAdminHost = typeof window !== 'undefined'
+    && window.location.hostname.toLowerCase().startsWith('admin.');
   isHomePage = signal(true);
   isAdminRoute = signal(false);
   checkingServer = signal(true);