fix: add Pages preview deployment CORS and init-data header

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/routes/api/dashboard.ts

@@ -17,11 +17,16 @@ const logger = createLogger('dashboard-api');
  */
 const dashboardRouter = new Hono<{ Bindings: Env }>();
 
-// CORS for my.anvil.it.com
+// CORS for dashboard domains
 dashboardRouter.use('*', cors({
-  origin: ['https://my.anvil.it.com', 'http://localhost:8788'],
+  origin: [
+    'https://my.anvil.it.com',
+    'https://my-anvil-dashboard.pages.dev',
+    /\.my-anvil-dashboard\.pages\.dev$/,  // Preview deployments
+    'http://localhost:8788',
+  ],
   allowMethods: ['GET', 'POST', 'OPTIONS'],
-  allowHeaders: ['Content-Type', 'Authorization'],
+  allowHeaders: ['Content-Type', 'Authorization', 'X-Telegram-Init-Data'],
   credentials: true,
 }));