fix: add admin CORS + optional header

app/main.py

@@ -32,11 +32,14 @@ app.add_middleware(
     allow_origins=[
         f"https://app.{s.DOMAIN}",
         f"https://data.{s.DOMAIN}",
+        f"https://admin.{s.DOMAIN}",
         "http://localhost:3000",
+        "http://localhost:8080",
     ],
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],
+    expose_headers=["*"],
 )
 
 app.include_router(auth.router)