fix(auth): accept configured public origin for sign-in

scripts/ci_container_smoke.sh

@@ -23,6 +23,7 @@ docker run --detach --name "$container_name" \
   --env JWT_SECRET=ci-only-secret-with-at-least-32-characters \
   --env SETTINGS_ENCRYPTION_KEY=AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= \
   --env ADMIN_PASSWORD=ci-only-bootstrap-password-123 \
+  --env MAGENT_APPLICATION_URL=https://magent-ci.example.test \
   magent:ci >/dev/null
 
 deadline=$((SECONDS + 120))
@@ -37,3 +38,27 @@ done
 
 docker exec "$container_name" curl --fail --silent --show-error http://127.0.0.1:8000/health >/dev/null
 docker exec "$container_name" curl --fail --silent --show-error http://127.0.0.1:3000/login >/dev/null
+
+# Exercise browser-origin requests, not only GET health checks. A configured
+# public address must work even when CORS_ALLOW_ORIGIN has its localhost default.
+docker exec -i "$container_name" python - <<'PY'
+from urllib import error, request
+
+for path in ("/auth/login", "/auth/jellyfin/login"):
+    for origin, expected in (
+        ("https://magent-ci.example.test", 422),
+        ("https://untrusted.example.test", 403),
+    ):
+        probe = request.Request(
+            "http://127.0.0.1:8000" + path,
+            data=b"",
+            headers={"Origin": origin, "Content-Type": "application/x-www-form-urlencoded"},
+        )
+        try:
+            response = request.urlopen(probe, timeout=10)
+        except error.HTTPError as exc:
+            response = exc
+        with response:
+            assert response.status == expected, (path, origin, response.status, expected)
+        print(f"Browser-origin login smoke: {path} {origin} -> {expected}")
+PY