Fixing cors issue in produciton

apps/edr-freight-api/src/main.ts

@@ -40,6 +40,13 @@ async function bootstrap() {
       "x-delegator-position-id",
       "x-current-project-id",
       "x-current-position-id",
+      // Headers sent by the freight-backoffice OKR/objective-service client
+      // (withHeaders.tsx, signatureAndTeeterService.ts, useIncomingReport.ts)
+      // under yet another naming convention — unprefixed "tenant-key"/"unit-id",
+      // and "x-delegated-position-id" (delegated, not delegator).
+      "tenant-key",
+      "unit-id",
+      "x-delegated-position-id",
     ],
     exposedHeaders: ["Content-Disposition"],
     maxAge: 86400, // cache preflight for 24h to cut chatter in dev