fix and update

apps/api-gateway/src/controllers/well-known.controller.ts

@@ -3,7 +3,6 @@ import { ApiOperation, ApiTags } from '@nestjs/swagger';
 import type { Request, Response } from 'express';
 import { CoreGrpcService } from '../core-grpc.service';
 import { buildFedcmWebIdentityManifest, resolveFedcmEndpoints } from '../lib/fedcm-config';
-import { assertFedcmWebIdentityRequest } from '../lib/fedcm-cors';
 import { buildOpenIdConfiguration, resolveOAuthIssuer } from '../lib/oauth-issuer';
 
 @ApiTags('OpenID Connect')
@@ -17,9 +16,11 @@ export class WellKnownController {
     description: 'Манифест Federated Credential Management API, указывающий на конфигурацию провайдера.'
   })
   async webIdentity(@Req() req: Request, @Res({ passthrough: true }) res: Response) {
-    assertFedcmWebIdentityRequest(req);
+    // Публичный discovery-манифест: без Sec-Fetch-Dest проверки (браузер FedCM шлёт
+    // webidentity или empty; ручной заход с document не должен ломать One Tap).
     res.setHeader('Content-Type', 'application/json; charset=utf-8');
     res.setHeader('Cache-Control', 'public, max-age=300');
+    res.setHeader('Access-Control-Allow-Origin', '*');
     const endpoints = await resolveFedcmEndpoints(this.core, req);
     return buildFedcmWebIdentityManifest(endpoints);
   }