feat(panel): serve authenticated app on dedicated panel subdomain

Separate the marketing landing site from the authenticated app by host.
Next.js middleware reads PANEL_HOST/LANDING_HOST at runtime and redirects
authenticated routes (/dashboard, /login, /register) from the landing host
to the panel host, and the landing root on the panel host to /dashboard.
Disabled (single-origin) when PANEL_HOST is unset, so local dev is unchanged.

Helm: add ingress.panel.host with a third ingress rule + TLS host routing to
the frontend service, pass LANDING_HOST/PANEL_HOST to the frontend, and append
the panel origin to the backend CORS list (frontend URL stays first so
PLATFORM_DOMAIN resolution is unaffected).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/helm/cloudhost-platform/templates/frontend-deployment.yaml

@@ -28,6 +28,14 @@ spec:
               value: "3000"
             - name: HOSTNAME
               value: "0.0.0.0"
+            {{- if .Values.ingress.panel.host }}
+            # Host-based separation: landing on frontend.host, authenticated
+            # panel on panel.host. Read by Next.js middleware at runtime.
+            - name: LANDING_HOST
+              value: {{ .Values.ingress.frontend.host | quote }}
+            - name: PANEL_HOST
+              value: {{ .Values.ingress.panel.host | quote }}
+            {{- end }}
           livenessProbe:
             httpGet:
               path: /