Header add Access-Control-Allow-Origin "*"
Header add Access-Control-Allow-Methods: "GET,POST,OPTIONS,DELETE,PUT"

# Webhook debug logs — not public pages (callbacks still work via PHP)
<FilesMatch "webhook\.html$">
    Require all denied
</FilesMatch>