From the account-first review (deferred — does not affect same-origin dev).
If STX_PUBLIC_API_ENDPOINT points the browser at a different origin than the dashboard (split-domain prod), the session gate and all credentialed fetches break: the cookie is scoped to the UI origin and the API answers Access-Control-Allow-Origin: * (which browsers forbid with credentials), so /api/auth/me is CORS-rejected and the dashboard silently fails open.
Scope: for session-bearing /api/* responses, echo the request Origin (from an allowlist) + Access-Control-Allow-Credentials: true instead of *; keep the public collect/script/sdk endpoints at * (cookie-free). Add credentials: 'include' to the remaining dashboard panel fetches. Document that authenticated installs are same-origin by default (the #116 proxy) and split-domain requires this.
Done when: a dashboard on origin A authenticates against an API on origin B.
Dev is same-origin via the serve.ts proxy (#116), so this only affects split-domain production.