feat(panel): serve authenticated app on dedicated panel subdomain

Separate the marketing landing site from the authenticated app by host.
Next.js middleware reads PANEL_HOST/LANDING_HOST at runtime and redirects
authenticated routes (/dashboard, /login, /register) from the landing host
to the panel host, and the landing root on the panel host to /dashboard.
Disabled (single-origin) when PANEL_HOST is unset, so local dev is unchanged.

Helm: add ingress.panel.host with a third ingress rule + TLS host routing to
the frontend service, pass LANDING_HOST/PANEL_HOST to the frontend, and append
the panel origin to the backend CORS list (frontend URL stays first so
PLATFORM_DOMAIN resolution is unaffected).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/helm/cloudhost-platform/templates/ingress.yaml

@@ -25,6 +25,9 @@ spec:
         - {{ .Values.ingress.singleHost.host | quote }}
         {{- else }}
         - {{ .Values.ingress.frontend.host | quote }}
+        {{- if .Values.ingress.panel.host }}
+        - {{ .Values.ingress.panel.host | quote }}
+        {{- end }}
         - {{ .Values.ingress.api.host | quote }}
         {{- end }}
       secretName: {{ include "cloudhost-platform.tlsSecretName" . }}
@@ -59,6 +62,18 @@ spec:
                 name: {{ include "cloudhost-platform.frontend.fullname" . }}
                 port:
                   number: 3000
+    {{- if .Values.ingress.panel.host }}
+    - host: {{ .Values.ingress.panel.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ include "cloudhost-platform.frontend.fullname" . }}
+                port:
+                  number: 3000
+    {{- end }}
     - host: {{ .Values.ingress.api.host | quote }}
       http:
         paths: