feat(deploy): production deployment setup and fixes

- Debian-based api image (bookworm-slim), docker/debian mirrors, prisma
  binaryTargets for openssl 3.0
- nginx: admin SPA under /admin, TLS via acme.sh (ZeroSSL) + auto-renewal
  cron, http->https redirect
- prisma: add origin_goods.delisted migration, sync missing schema
  (good_image/tag_font_color/good_tags), fix users.createdAt Timestamptz
- api: CORS wildcard reflection, helmet CORP cross-origin, price
  backfill in persistProductDetail, categoryIcon ancestor fallback,
  mediaByColor per-color gallery in public goods detail
- admin: /admin base path (vite + router)
- import-data.mjs: udt_name casting, serial sequence advance fix

apps/api/src/main.ts

@@ -31,7 +31,9 @@ async function bootstrap() {
   );
 
   // Security headers (X-Content-Type-Options, X-Frame-Options, CSP, HSTS, ...)
-  app.use(helmet());
+  // Static assets (/uploads, /assets) are embedded cross-origin by other
+  // sites, so CORP must allow cross-origin reads.
+  app.use(helmet({ crossOriginResourcePolicy: { policy: 'cross-origin' } }));
 
   // Parse auth cookies (HttpOnly access/refresh tokens). Resolve both the
   // namespace and its `default` interop shape so it works regardless of
@@ -45,12 +47,14 @@ async function bootstrap() {
 
   // CORS: only origins listed in CORS_ORIGINS (comma-separated) are
   // allowed. Credentials are enabled because the session lives in
-  // HttpOnly cookies.
+  // HttpOnly cookies. "*" disables the allowlist and reflects any origin
+  // (reflected origins are required when credentials are enabled).
   const corsOrigins = (process.env.CORS_ORIGINS ?? '')
     .split(',')
     .map((o) => o.trim())
     .filter(Boolean);
-  app.enableCors(corsOrigins.length > 0 ? { origin: corsOrigins, credentials: true } : undefined);
+  const origin = corsOrigins.includes('*') ? true : corsOrigins;
+  app.enableCors(corsOrigins.length > 0 ? { origin, credentials: true } : undefined);
 
   // Serve uploaded files. nosniff prevents browsers from sniffing a
   // non-image content type out of an uploaded file.