Support-A-Creator — CORS Origin-Allowlist Bypass

* Access-Control-Allow-Origin is not a CORS-safelisted response header, so page script cannot print its literal value. A delivered cross-origin body is the proof the check passed; the literal headers are in the report's curl output (Parts A–E).