fix: ( payments ) bounce D-Money checkout via /go and follow user domain

apps/edr-passenger-api/src/modules/payments/payments.controller.ts

@@ -415,8 +415,18 @@ export class PaymentsController {
   paySupplementaryCharge(
     @Param('token') token: string,
     @Body() dto: PaySupplementaryChargeDto,
+    @Headers('origin') origin?: string,
+    @Headers('referer') referer?: string,
+    @Headers('x-frontend-base-url') frontendBaseUrl?: string,
   ) {
-    return this.supplementaryService.pay(token, dto.method, dto.platform);
+    // Same domain-follows-the-user rule as /initiate — the self-pay page can be
+    // opened on either portal domain.
+    return this.supplementaryService.pay(
+      token,
+      dto.method,
+      dto.platform,
+      resolveAllowedOrigin(origin, referer, frontendBaseUrl),
+    );
   }
 
   @Post('supplementary/:id/mark-paid')