Move allowed_domains configuration from per-request payload to the ALLOWED_DOMAINS environment variable (comma-separated), since expecting users to send this with every request is not feasible. Co-authored-by: Claude Opus 4.6 (1M context) <[email protected]>