users.vitanova.network:456 flatly 403s the CORS preflight for
https://admin.gorbushka.market (no CORS headers at all) while
https://novo.market gets a full grant (204, explicit
Access-Control-Allow-Origin + wildcard Allow-Headers). This is a
server-side origin allowlist, not something the frontend can route
around - confirmed live via curl OPTIONS against both origins.
This makes item 1 (X-Marketplace-Domain CORS confirmation) load-bearing
for the gorbushka admin login fix in progress on the marketplaces repo:
the frontend fix is ready but cannot work until this origin is added.
Convenience wrapper around MarketplacesAuthGateway.loginWithCredentials('admin', ...)
that activates the returned session in one call, for apps building a custom admin
login screen. AuthFailure gains a rate_limited code (HTTP 429, parsed Retry-After)
and an optional status field so 401/403/429 surface distinctly without new plumbing.
No credentials, no client-side comparison, no superadmin concept anywhere in this
package - same code path as any other admin credential login. Inert without a
backend implementing POST {credentialsPath} { login, password, mode: 'admin' }.
Additive, backward-compatible. QR/Yandex flows unmodified.
