fix(deploy): use JSON list format for CORS origins in stage

[jsell-rh]

Summary

KARTOGRAPH_CORS_ORIGINS is a list[str] field in pydantic-settings, which requires JSON list format. The comma-separated string was failing to parse, so CORS middleware never initialized — causing 405 on OPTIONS preflight requests.

Verified locally: comma-separated → parse error, JSON list → works.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Chores
  • Updated CORS origin configuration in the staging environment with format changes.

[coderabbitai]

Caution

Review failed

Pull request was closed or merged during review

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Enterprise

Run ID: 3c122d8f-68ce-4232-8a3c-dbcff709ffb0

📥 Commits

Reviewing files that changed from the base of the PR and between fc053f2 and 97e5df4.

📒 Files selected for processing (1)

• deploy/apps/kartograph/overlays/stage/configmap-patch.yaml

---

Walkthrough

A Kubernetes ConfigMap resource in the staging environment overlay is updated to modify the CORS origins configuration for the Kartograph service. The KARTOGRAPH_CORS_ORIGINS field changes from a comma-separated list of two origins to a JSON array format containing a single origin. This removes https://kartograph-stage.devshift.net from the allowed CORS origins while maintaining the remaining origin in a different string format.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title accurately and specifically describes the main change: converting CORS origins format from comma-separated to JSON list format in the stage environment.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch jsell/fix/cors-origins-format

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}