feat(gateway,buyer): self-serve "Generate API key" page in the frontend

Add an "API Keys" page to the buyer SPA (marketplace.vector.apexfusion.org)
that mints a custodial gateway API key by POSTing directly to the gateway's
public /signup, then shows the key once + deposit address + a base_url/curl
usage snippet. Page lives behind the SPA's existing operator login; per-user
registration is a later feature.

Gateway:
- GATEWAY_CORS_ORIGINS env -> corsOrigins allowlist; corsMiddleware echoes
  Access-Control-* only for allowlisted Origins, answers OPTIONS preflight
  204, no credentials. Empty allowlist = CORS off (default safe).

Buyer:
- GATEWAY_PUBLIC_URL env -> injected into __BUYER_BOOT__.gatewayUrl (only in
  the authenticated boot block). SPA resolveGatewayUrl() falls back to
  deriving "api." + location.host so the post-login-no-reload case (boot
  block absent) still works.
- New ApiKeys page + /api-keys route + nav link.

Deploy (mainnet compose): gateway GATEWAY_CORS_ORIGINS and buyer
GATEWAY_PUBLIC_URL set to the marketplace/api hosts. NOTE: both images must be
REBUILT (gateway runs tsx from copied source; buyer SPA is vite-built at image
build) — an env-only recreate would silently ship the old code.

Typecheck + vite build clean; 205 tests pass. Adversarial multi-agent review
(4 dimensions, per-finding verification) surfaced only the rebuild-required
deploy note above; no code/security defects.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

deploy/mainnet/docker-compose.buyer.yml

@@ -29,6 +29,11 @@ services:
       # the response archive + PDF job store (past summaries) across container
       # recreation/redeploys.
       ARCHIVE_DIR: /repo/data/archive
+      # Public base URL of the OpenAI gateway, surfaced to the SPA boot block so
+      # the "API Keys" page can POST cross-origin to ${gatewayUrl}/signup. The
+      # gateway must CORS-allow https://marketplace.vector.apexfusion.org (see
+      # GATEWAY_CORS_ORIGINS in docker-compose.gateway.yml).
+      GATEWAY_PUBLIC_URL: https://api.marketplace.vector.apexfusion.org
       # NETWORK_ID intentionally not pinned — see supplier compose comment.
     volumes:
       - buyer-mainnet-archive:/repo/data/archive

deploy/mainnet/docker-compose.gateway.yml

@@ -34,6 +34,10 @@ services:
       # Accept/Reclaim/Submit. Same values the buyer/suppliers use on mainnet.
       ESCROW_REF_UTXO: c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#0
       ADVERT_REF_UTXO: c8d84c6d67ec67a1efe5e9c6c06d53020e05d1bb96d1c55ecb1eb7d5010c4d54#1
+      # Browser Origins allowed to call the gateway cross-origin. The buyer
+      # frontend's "API Keys" page (served from marketplace.vector…) POSTs to
+      # /signup here. Comma-separated; empty disables CORS entirely.
+      GATEWAY_CORS_ORIGINS: https://marketplace.vector.apexfusion.org
     volumes:
       - gateway-mainnet-data:/repo/data/gateway
     healthcheck: