CORS: lab.hoortrend.com may read /api/info and /healthz
The lab moved to its own site, https://lab.hoortrend.com, which shows demo-app live like hoortrend.com and the portfolio. Its origin is added to ALLOWED_ORIGINS (read-only, /api/info and /healthz only); the CORS test covers it.