fix(proxy): strip upstream browser origin

nginx owns the validated CORS response; the live :445 backend rejects requests when the browser Origin is forwarded.

scripts/deploy/configure-api-domain.sh

@@ -72,6 +72,9 @@ server {
         proxy_set_header Host              \$storefront_host;
         proxy_set_header X-Forwarded-Host  $API_DOMAIN;
         proxy_set_header X-Storefront-Host \$storefront_host;
+        # nginx has already validated and answered CORS. The existing backend
+        # rejects browser Origin on :445, so do not forward it a second time.
+        proxy_set_header Origin            "";
         proxy_set_header X-Real-IP         \$remote_addr;
         proxy_set_header X-Forwarded-For   \$proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto https;