feat(dashboard): declare external assets cross-origin

[walker-tx]

AIS-552

Summary

• Serve every /external/* dashboard resource with Cross-Origin-Resource-Policy: cross-origin and the existing wildcard CORS policy.
• Preserve the pentest-approved same-origin value on dashboard HTML and SPA fallback responses.
• Include the approved Gram and CDN implementation plans.

Motivation

The public sticker logo is embedded by install pages on custom domains. Giving the /external resource family an explicit permissive policy preserves that supported cross-site load without weakening the dashboard HTML remediation.

Stack

This is the base of a two-PR Gram stack. The follow-up adds the same explicit policy to uploaded image responses.

Rollout gates

• After dev deployment, confirm dashboard HTML remains exactly same-origin and the sticker response is cross-origin.
• Confirm default sticker branding renders on a custom-domain install page, then repeat the header checks after production promotion.

Related PRs

• Gram follow-up: feat(server): declare public image assets cross-origin #5916
• CDN companion: https://github.com/speakeasy-api/gram-infra/pull/2966

[linear-code]

AIS-552

[changeset-bot]

⚠️ No Changeset found

Latest commit: ce9b23e

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

All reported issues were addressed across 3 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>