fix: append .onrender.com for bare Render hostnames and clean CORS pa…

frontend/src/api.ts

@@ -19,8 +19,10 @@ const TOKEN_KEY = 'settleup.token'
  * expose service hostnames without a scheme and do not support string interpolation), and we
  * prepend https:// ourselves.
  */
-const API_HOST = import.meta.env.VITE_API_HOST as string | undefined
-const API_ROOT = API_HOST ? `https://${API_HOST.replace(/^https?:\/\//, '')}` : ''
+const rawHost = (import.meta.env.VITE_API_HOST as string | undefined)?.trim().replace(/^https?:\/\//, '')
+const isLocal = rawHost?.startsWith('localhost') || rawHost?.startsWith('127.0.0.1')
+const API_HOST = rawHost && !rawHost.includes('.') && !isLocal ? `${rawHost}.onrender.com` : rawHost
+const API_ROOT = API_HOST ? (isLocal ? `http://${API_HOST}` : `https://${API_HOST}`) : ''
 
 /** Absolute URL for an API path, used for links the browser follows directly (e.g. CSV export). */
 export function apiUrl(path: string): string {

render.yaml

@@ -71,7 +71,7 @@ services:
       # reference each other and the Blueprint would fail to resolve the cycle. The wildcard gets
       # the first deploy working; tighten it to the exact origin afterwards (see README).
       - key: CORS_ALLOWED_ORIGINS
-        value: https://settleup-web.onrender.com/**
+        value: https://*.onrender.com,https://settleup-web.onrender.com
 
   # ---------------------------------------------------------------- Cache
   - type: keyvalue

src/main/resources/application-prod.yml

@@ -54,7 +54,7 @@ settleup:
   cors:
     # Set to the exact frontend origin once it is known. The default permits any Render subdomain
     # so the first deploy works before the static site URL has been assigned.
-    allowed-origins: ${CORS_ALLOWED_ORIGINS:https://settleup-web.onrender.com/**}
+    allowed-origins: ${CORS_ALLOWED_ORIGINS:https://*.onrender.com,https://settleup-web.onrender.com}
 
 logging:
   level: