Anonymous may call from the API's own origin, for Apollo Sandbox

[swantzter]

The landing page at https://api.the-tricktionary.com/graphql embeds Apollo Sandbox. Sandbox sends its requests from the page, so they carry Origin: https://api.the-tricktionary.com. Since #87 no client allowed that origin, so every Sandbox request, introspection included, got a 403.

• anonymous gets apiOrigins: the API's own origin, plus localhost for a local API's Sandbox. It was [] before. Anonymous still only holds public.
• A preflight's origins include anonymous's too, so the registry's union really is every client's origins.
• Keys are still denied from the API's origin unless their client lists it. The Sandbox is for exploring the public schema anonymously.
• Mux uploads are unaffected: allowedOrigins still only lists web and admin.

Checked

Against a local API on the Firestore emulator, without a key:

Origin	Query	Result
https://api.the-tricktionary.com	introspection	200
https://api.the-tricktionary.com	tricks (public)	200
https://api.the-tricktionary.com	globalStats (site)	403 INSUFFICIENT_SCOPE
http://localhost:5077 (the API itself)	introspection	200
https://evil.example	introspection	403, needs an API key
https://api.the-tricktionary.com.evil.example	__typename	403, needs an API key

The first row reproduces the production failure: production answers it with a 403 now. lint, typecheck and schema:check pass.

🤖 Generated with Claude Code

https://claude.ai/code/session_01QFzXAPK2agUfrXXhH8M9AG

---

Generated by Claude Code