Fix ladl.link CORS for Mini payment assets and pay URL.

Allow cross-origin module loads of Mini build assets and use a same-origin
pay path when HTML is proxied through ladl.link so fetch and Vite JS work.

tests/Feature/MiniPaymentCheckoutTest.php

@@ -46,8 +46,9 @@ class MiniPaymentCheckoutTest extends TestCase
             ->assertSee('data-ladill-pay-sheet', false)
             ->assertSee('data-ladill-pay-panel', false)
             ->assertSee('resumeTransaction', false)
-            ->assertSee('/q/'.$qr->short_code.'/pay', false)
-            ->assertDontSee('https://ladl.link/'.$qr->short_code.'/pay', false)
+            // Proxied ladl.link scans use same-origin /{code}/pay (not mini absolute /q/...).
+            ->assertSee('/'.$qr->short_code.'/pay', false)
+            ->assertDontSee('https://mini.ladill.com/q/'.$qr->short_code.'/pay', false)
             ->assertDontSee('MTN MoMo number', false)
             ->assertDontSee('Pay with MTN MoMo', false)
             ->assertDontSee('Continue to Paystack', false)

tests/Feature/MiniPaymentCorsTest.php

@@ -0,0 +1,73 @@
+<?php
+
+namespace Tests\Feature;
+
+use App\Models\QrCode;
+use App\Models\User;
+use Illuminate\Foundation\Testing\RefreshDatabase;
+use Illuminate\Support\Str;
+use Tests\TestCase;
+
+class MiniPaymentCorsTest extends TestCase
+{
+    use RefreshDatabase;
+
+    public function test_proxied_payment_landing_uses_same_origin_pay_path(): void
+    {
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Vendor',
+            'email' => 'vendor-cors@example.com',
+        ]);
+
+        $qr = QrCode::query()->create([
+            'user_id' => $user->id,
+            'short_code' => 'paycors01',
+            'type' => QrCode::TYPE_PAYMENT,
+            'label' => 'Till',
+            'payload' => [
+                'content' => [
+                    'business_name' => 'Accra Kiosk',
+                    'currency' => 'GHS',
+                ],
+                'style' => [],
+            ],
+            'is_active' => true,
+        ]);
+
+        $html = $this->withHeader(\App\Support\LadillLink::INTERNAL_HEADER, '1')
+            ->get('/q/'.$qr->short_code)
+            ->assertOk()
+            ->getContent();
+
+        $this->assertStringContainsString('paycors01/pay', $html);
+        $this->assertStringNotContainsString('https://mini.ladill.com/q/paycors01/pay', $html);
+    }
+
+    public function test_payment_landing_redirects_non_internal_to_public_host(): void
+    {
+        $user = User::create([
+            'public_id' => (string) Str::uuid(),
+            'name' => 'Vendor',
+            'email' => 'vendor-mode@example.com',
+        ]);
+
+        $qr = QrCode::query()->create([
+            'user_id' => $user->id,
+            'short_code' => 'paymode1',
+            'type' => QrCode::TYPE_PAYMENT,
+            'label' => 'Till',
+            'payload' => [
+                'content' => [
+                    'business_name' => 'Accra Kiosk',
+                    'currency' => 'GHS',
+                ],
+                'style' => [],
+            ],
+            'is_active' => true,
+        ]);
+
+        // Direct hit (no internal header) is redirected to ladl.link by legacy middleware.
+        $this->get('/q/'.$qr->short_code)->assertRedirect();
+    }
+}