Remove an allowed origin from the partner

Manage the partner’s allowed-origins list.

POST adds an origin (idempotent — adding an existing origin is a no-op). DELETE with ?origin=… removes one (404 if not present, so the partner knows their request had no effect).

Origins gate write-path CORS — adding a new app domain shouldn’t require a Flexslot admin to do anything. This is the most common partner self-service action.