fix the errors in dashboard

apps/api/src/app.ts

@@ -78,6 +78,15 @@ export function createApp() {
     res.status(404).end()
   })
 
+  // Public storage assets (logos, vehicle photos, etc.) must be loadable cross-origin
+  // by the browser. Without this header, helmet's default CORP: same-origin reaches
+  // 404 responses (when express.static calls next() on a miss) and the browser blocks
+  // the response even for broken-image cases, producing ERR_BLOCKED_BY_RESPONSE.
+  app.use('/storage', (_req, res, next) => {
+    res.setHeader('Cross-Origin-Resource-Policy', 'cross-origin')
+    next()
+  })
+
   // Serve uploaded assets from the configured storage root, with a legacy fallback
   // for older files that were written under the previous API-local path.
   app.use('/storage', express.static(getStorageRoot()))
@@ -88,7 +97,10 @@ export function createApp() {
   // Webhook must use raw body BEFORE express.json()
   app.use('/api/v1/webhooks', express.raw({ type: 'application/json' }), webhookRouter)
 
-  app.use(helmet())
+  // Let /storage responses manage CORP explicitly so missing files still return
+  // a normal cross-origin 404 instead of being blocked by Helmet's default
+  // same-origin policy.
+  app.use(helmet({ crossOriginResourcePolicy: false }))
   if (process.env.NODE_ENV !== 'test') app.use(morgan('combined'))
   app.use(express.json({ limit: '10mb' }))