Stand up the landing page hostname and add CORS on /mcp

[sergical]

Part of #42

Blocked by #43

Question

Stand up the landing page's own hostname, and add the CORS header the demo needs.

Cloudflare Access is not touched. #43 established there is no way to carve / out of the bare-host OAuth application — Access path matching is a segment-wise prefix, and the root path is a prefix of everything. The apex stays as it is; the page gets its own hostname instead.

Decide and do:

• Pick the hostname. Settled 2026-08-22: plausible-mcp.sentry.cool. The sentry.cool zone is active on the same Cloudflare account as the Worker (zone e16d34473c09e34bc61b5c744b2f2eb7), holds only two unrelated junior-dev tunnel records, and has no apex record — the hostname is free and nothing conflicts. A .cool domain also matches the effort's framing: a DX-team artifact, not a supported Sentry product.
• Route it to the same Worker as a second custom domain in wrangler.toml routes, so one deploy serves both, and the page is an inline HTML string on that hostname's / (per Serve HTML at the Worker root without breaking /mcp or /internal #43's serving recommendation). Add the hostname to MCP_ALLOWED_HOSTNAMES.
• Add CORS on /mcp so the demo can call it from the page's origin — largely a matter of adding plausible-mcp.sentry.cool to the existing MCP_ALLOWED_ORIGIN_HOSTNAMES var rather than new machinery. Scope it to that origin; do not open it to *.
• Confirm classifyRoute still treats the page as untracked, so anonymous visitors record no telemetry (TELEMETRY.md).

Verify when done:

• https://plausible-mcp.sentry.cool/ serves HTML with no Access challenge.
• plausible-mcp.sentry.dev/internal still challenges for Access and still grants only @sentry.io.
• plausible-mcp.sentry.dev/mcp still accepts a bearer Plausible API key, and now also answers a cross-origin preflight from the page's origin.
• Existing /internal connector URLs are unchanged — nobody re-authorizes.