fix: fetch collators from parachains and restrict CORS to production domains

- NetworkStats now queries Asset Hub and People Chain for collator data
  instead of relay chain (where collatorSelection doesn't exist)
- Restrict Edge Functions CORS to app.pezkuwichain.io domains only
- Add Access-Control-Allow-Credentials header for secure cross-origin requests

web/supabase/functions/process-withdrawal/index.ts

@@ -177,10 +177,20 @@ async function processWithdrawal(
  * Main handler
  */
 serve(async (req: Request) => {
-  // CORS headers
+  // Allowed origins for CORS
+  const ALLOWED_ORIGINS = [
+    'https://app.pezkuwichain.io',
+    'https://www.pezkuwichain.io',
+    'https://pezkuwichain.io',
+  ]
+
+  const requestOrigin = req.headers.get('Origin')
+  const allowedOrigin = requestOrigin && ALLOWED_ORIGINS.includes(requestOrigin) ? requestOrigin : ALLOWED_ORIGINS[0]
+
   const headers = {
-    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Origin": allowedOrigin,
     "Access-Control-Allow-Headers": "authorization, x-client-info, apikey, content-type",
+    "Access-Control-Allow-Credentials": "true",
     "Content-Type": "application/json",
   };