Pulled the fuller detail from vitanovaPackages/BACKEND-TODO.md (root-caused
2026-08-24, more precise than this file's original note): it's an origin
allowlist gap specifically (novo.market works, gorbushka doesn't), plus
the X-Marketplace-Domain header requirement, the qr.vitanova.network
allowlist question, the Retry-After rate-limit contract, and ed25519's
dead-export status. None of that was here before.
Also documents that backend TODOs are NOT fully consolidated: this file
is canonical for marketplaces, but vitanovaPackages/BACKEND-TODO.md is a
separate file in a separate repo and stays the source of truth for
package-level backend asks - mirrored here, not merged away.
593870c36e