Improve CORS origin handling; extend invoice repo/service and payments dispatch; rate limit and nginx config updates

Made-with: Love

deploy/nginx.conf

@@ -45,7 +45,8 @@ server {
         proxy_http_version 1.1;
         proxy_set_header Connection "";
 
-        add_header Access-Control-Allow-Origin "*" always;
+        # Do not set CORS headers here — nip05api sends a single reflected Origin (see FRONTEND_URL / CORS_* env).
+        # Duplicate ACAO headers break browsers ("multiple values").
         add_header Cache-Control "public, max-age=60" always;
     }