fix(security): trust deployed CSRF origin

The live hostname is comp2care.com while the previous configuration only trusted com2care.com. Always include both production domain variants so stale environment overrides cannot block admin login.

config/settings/production.py

@@ -6,7 +6,21 @@ SECRET_KEY = os.environ["DJANGO_SECRET_KEY"]
 
 DEBUG = False
 
-ALLOWED_HOSTS = os.environ.get("ALLOWED_HOSTS", "").split(",")
+PRODUCTION_HOSTS = {
+    "com2care.com",
+    "www.com2care.com",
+    "comp2care.com",
+    "www.comp2care.com",
+}
+
+ALLOWED_HOSTS = sorted(
+    PRODUCTION_HOSTS
+    | {
+        host.strip()
+        for host in os.environ.get("ALLOWED_HOSTS", "").split(",")
+        if host.strip()
+    }
+)
 
 SECURE_HSTS_SECONDS = 31536000
 SECURE_HSTS_INCLUDE_SUBDOMAINS = True
@@ -18,8 +32,11 @@ SECURE_BROWSER_XSS_FILTER = True
 SECURE_CONTENT_TYPE_NOSNIFF = True
 X_FRAME_OPTIONS = "DENY"
 
-CSRF_TRUSTED_ORIGINS = [
-    origin.strip()
-    for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
-    if origin.strip()
-]
+CSRF_TRUSTED_ORIGINS = sorted(
+    {f"https://{host}" for host in PRODUCTION_HOSTS}
+    | {
+        origin.strip()
+        for origin in os.environ.get("CSRF_TRUSTED_ORIGINS", "").split(",")
+        if origin.strip()
+    }
+)