docs(security): note DefaultOrigin is a single global, not per-tenant

Address the MEDIUM review point on #1323: operator-driven register/resend
point every tenant's e-mail link at the one DefaultOrigin SPA. Fits the
kit's single-dashboard model; a per-tenant-custom-domain deployment would
resolve the recipient tenant's own origin instead.

Author: marcelo-maciel

src/content/docs/security/cors-and-headers.mdx

@@ -1,6 +1,6 @@
 ---
 title: CORS & security headers
-lastUpdated: 2026-07-02
+lastUpdated: 2026-07-13
 description: CORS-before-HTTPS-redirect ordering, the SignalR-credentialed-CORS gotcha, and the production security headers the kit emits by default.
 sidebar:
   label: CORS & headers
@@ -68,6 +68,7 @@ Links that land on a front-end SPA — the password-reset and e-mail-confirmatio
 - **Self-service flows** (`forgot-password`, `self-register`) build the link from the request `Origin` header, validated against `AllowedOrigins` and returned as the canonical list entry — so with more than one SPA each user gets a link back to the app they started from. Because forgot-password is anonymous this is a security boundary: a **forged/unlisted `Origin` is rejected with `400`** rather than turned into a link. A request with **no** `Origin` header (curl, the Scalar try-it UI, mobile, server-to-server) falls back to `DefaultOrigin` instead of failing.
 - **Operator-driven flows** (`register`, `resend-confirmation-email`) target `DefaultOrigin` — the recipient's app — not the calling operator's origin, so a tenant user provisioned from the admin console gets a link into the tenant app, not the console.
 - Matching is component-wise (scheme + host + port, port exact). Startup validation **fails the boot** if neither `AllowedOrigins` nor `DefaultOrigin` is set, so a missing config surfaces loudly instead of 500-ing on the first reset. `appsettings.Production.json` ships both empty — you must configure them (see the [production checklist](/docs/security/production-checklist/)).
+- `DefaultOrigin` is a **single global**, not per-tenant or custom-domain aware, so operator-driven `register` / `resend-confirmation-email` point every tenant's link at that one SPA. That fits the kit's single-dashboard model; a deployment with per-tenant custom domains would need to resolve the recipient tenant's own origin instead.
 
 (`OriginOptions:OriginUrl` is unrelated: it's the API's own public base for back-end-served assets such as avatar URLs, exposed via `IRequestContext.Origin`.)