small prod changes

server/server.js

@@ -17,10 +17,20 @@ const allowedOrigins = [
 	'capacitor://localhost',
 	'https://10.0.2.2:5173',
 	'http://localhost:5173'
-];
+].filter(Boolean).map(uri => uri.replace(/\/$/, ''));
 
 await fastify.register(cors, {
-	origin: allowedOrigins,
+	origin: (origin, cb) => {
+		if (!origin) return cb(null, true);
+
+		if (allowedOrigins.includes(origin)) {
+			return cb(null, true);
+		}
+
+		console.log(`CORS BLOCKED: Browser sent "${origin}". Allowed list:`, allowedOrigins);
+
+		cb(new Error("Not allowed by CORS"));
+	},
 	methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
 	credentials: true
 });