recorder.js lacks CORS headers unlike script.js #4426

Describe the Bug

next.config.ts adds Access-Control-Allow-Origin: * only for TRACKER_SCRIPT = '/script.js' (and /api/*). /recorder.js has no headers entry, so embedding it with crossorigin="anonymous" + integrity fails with a CORS error, while the same attributes work fine on script.js.

curl -sI https://analytics.example.com/script.js | grep -i "access-control-allow-origin: *"
access-control-allow-origin: *

curl -sI https://analytics.example.com/recorder.js | grep -i "access-control-allow-origin: *"

Database

PostgreSQL

Relevant log output

Which Umami version are you using?

3.2.0

How are you deploying your application?

Docker

Which browser are you using?

Brave, Firefox