fix: statisc

config/coruna.php

@@ -7,12 +7,19 @@ $parseDomains = static fn (string $value): array => array_values(array_filter(ar
 // Optional link-display hosts (not used by the DGA binary patch).
 $channelDomains = $parseDomains((string) env('CORUNA_LAB_CHANNEL_DOMAINS', ''));
 $reportingDomains = $parseDomains((string) env('CORUNA_REPORTING_DOMAINS', ''));
+// Panel Host allowlists (empty = no restriction). Overridable via system settings.
+$adminHosts = $parseDomains((string) env('CORUNA_ADMIN_HOSTS', ''));
+$agentHosts = $parseDomains((string) env('CORUNA_AGENT_HOSTS', ''));
 
 return [
     'session_key' => env('CORUNA_SESSION_KEY'), // optional override; empty = derive(seed=0)
     'channel_domains' => $channelDomains,
     'deployment_domains' => $channelDomains,
     'reporting_domains' => $reportingDomains,
+    'panel' => [
+        'admin_hosts' => $adminHosts,
+        'agent_hosts' => $agentHosts,
+    ],
     'static_site' => [
         // Scheme used when CORUNA_LAB_CHANNEL_DOMAINS entries omit https://.
         'scheme' => env('CORUNA_STATIC_SITE_SCHEME', 'https'),