feat(panel): serve authenticated app on dedicated panel subdomain

Separate the marketing landing site from the authenticated app by host.
Next.js middleware reads PANEL_HOST/LANDING_HOST at runtime and redirects
authenticated routes (/dashboard, /login, /register) from the landing host
to the panel host, and the landing root on the panel host to /dashboard.
Disabled (single-origin) when PANEL_HOST is unset, so local dev is unchanged.

Helm: add ingress.panel.host with a third ingress rule + TLS host routing to
the frontend service, pass LANDING_HOST/PANEL_HOST to the frontend, and append
the panel origin to the backend CORS list (frontend URL stays first so
PLATFORM_DOMAIN resolution is unaffected).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/helm/cloudhost-platform/templates/_helpers.tpl

@@ -74,6 +74,21 @@ app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 {{- end }}
 
+{{- /*
+Comma-separated CORS origins for the backend's FRONTEND_URL.
+The frontend (landing) URL MUST stay first: configuration.ts derives
+PLATFORM_DOMAIN / preview domain from the first entry only. The panel host
+(when configured) is appended as an additional allowed origin.
+*/ -}}
+{{- define "cloudhost-platform.corsOrigins" -}}
+{{- $scheme := include "cloudhost-platform.urlScheme" . -}}
+{{- $origins := list (include "cloudhost-platform.frontendPublicUrl" .) -}}
+{{- if and .Values.ingress.enabled .Values.ingress.panel.host -}}
+{{- $origins = append $origins (printf "%s://%s" $scheme .Values.ingress.panel.host) -}}
+{{- end -}}
+{{- join "," $origins -}}
+{{- end }}
+
 {{- define "cloudhost-platform.apiPublicUrl" -}}
 {{- $scheme := include "cloudhost-platform.urlScheme" . -}}
 {{- if .Values.ingress.enabled }}