fix(#260): restore admin portal CORS access to AI backend

[mottych]

Summary

• Fix production CORS incident for admin portal access to AI backend across all environments.
• Expand API Gateway CORS allowlist to include admin and both www/non-www frontend variants.
• Tighten FastAPI CORS middleware regex to only allow purposepath.app (remove accidental purpopsepath.app).

Root cause

API Gateway CORS allow_origins did not include admin portal origins. Browser preflight requests were rejected at API Gateway before FastAPI middleware could apply CORS headers.

Validation

• ✅ uv run mypy coaching/src shared/ --explicit-package-bases
• ⚠️ uv run ruff check coaching/ shared/ --fix fails due pre-existing repo-wide UP042 findings unrelated to this hotfix
• ⚠️ uv run --no-sync pytest fails during collection with environment dependency issue: ImportError: cannot import name 'BeautifulSoup' from 'bs4'
• ✅ File-level lint on modified files passes

Preprod + production verification plan

• Validate preprod browser preflight and functional AI calls from admin origins.
• After preprod success, merge to master and monitor production deployment.
• Validate production preflight + functional calls from admin origin.

Incident scope control

This PR intentionally changes only CORS configuration and origin-matching logic required for the incident.

[pulumi]

🍹 The Update for mottych/purposepath-coaching-api/preprod (at 21f93d3) was successful.

✨ Neo Explanation

This deployment pushes updated application code to the preprod Lambda function and expands the API's CORS policy to permit requests from additional frontend and admin subdomains.

Root Cause Analysis

Two independent changes are being deployed together: (1) new application code has been built into a fresh Docker image, and (2) the API Gateway CORS configuration has been expanded to allow additional origins.

Dependency Chain

• Docker image rebuild → new image digest pushed to ECR → Lambda function updated to point to the new image (code deployment to the preprod environment).
• CORS expansion → API Gateway updated to allow 11 additional origins, including www variants of dev/staging/preprod environments and several admin subdomains (dev.admin, staging.admin, preprod.admin, admin.purposepath.app). This is a standalone config change on the API Gateway.

Risk analysis

No stateful resources (databases, storage) are being modified or replaced. The Lambda update is an in-place image swap with no replacement. The CORS change is additive (origins are being added, none removed). No downtime or data loss risk.

Resource Changes

    Name            Type                          Operation
~   coaching-api    aws:apigatewayv2/api:Api      update
~   coaching-api    aws:lambda/function:Function  update
~   coaching-image  docker:index/image:Image      update