fix(cors): add API domain to CORS origins and improve instance error handling

- Add API base URL to CORS allowed origins alongside web base URL
- Add CORS origin logging on startup for debugging
- Wrap instance creation in try/except with detailed error logging
- Return proper error message instead of raw 500 for instance creation failures

This fixes CORS errors when the frontend makes cross-origin requests and
provides better diagnostics for instance creation failures.

apps/api/src/api/tool_instances.py

@@ -124,6 +124,7 @@ async def create_instance(
             status_code=status.HTTP_404_NOT_FOUND, detail="tool type not found"
         )
 
+    try:
         # Generate unique name
         instance_name = f"{tool_type.name}-{repo.name}-{uuid.uuid4().hex[:8]}"
         instance_display = data.display_name or f"{tool_type.display_name} - {repo.name}"
@@ -171,6 +172,12 @@ async def create_instance(
             "status": instance.status,
             "created_at": instance.created_at.isoformat(),
         }
+    except Exception as exc:
+        logger.exception("Failed to create instance: %s", exc)
+        raise HTTPException(
+            status_code=status.HTTP_500_INTERNAL_SERVER_ERROR,
+            detail=f"Failed to create instance: {exc}",
+        )
 
 
 @router.get(

apps/api/src/main.py

@@ -38,9 +38,15 @@ settings = Settings()
 app = FastAPI(title="Headquarter API")
 
 # Configure CORS - must be before other middleware
+# Build allowed origins list including web and api domains
+cors_origins = [settings.web_base_url]
+if settings.api_base_url != settings.web_base_url:
+    cors_origins.append(settings.api_base_url)
+logger.info("CORS configured with origins: %s", cors_origins)
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=[settings.web_base_url],
+    allow_origins=cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],