object storage related updates

src/main.ts

@@ -21,8 +21,13 @@ async function bootstrap() {
   const appEnv = configService.get<string>('app.env') || 'development';
   const corsOrigins = configService.get<string[]>('cors.origins') || [];
 
-  // Security
-  app.use(helmet());
+  // Security — allow cross-origin API reads from frontend/admin domains
+  app.use(
+    helmet({
+      crossOriginResourcePolicy: { policy: 'cross-origin' },
+      crossOriginOpenerPolicy: { policy: 'same-origin-allow-popups' },
+    }),
+  );
   app.use(cookieParser());
 
   // CORS