fix: production frontend is chat.studentcompanionai.rw — allow CORS + redirect there

The student PWA now lives at chat.studentcompanionai.rw (Vercel project
deploying Donne120/Student_companion), not the legacy vercel.app domains.
Add it to the default CORS origins and make it the default OAuth
post-consent redirect.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

email_briefing.py

@@ -23,7 +23,7 @@ Configuration (HF Space secrets)
     GOOGLE_OAUTH_CLIENT_SECRET
     BACKEND_PUBLIC_URL          e.g. https://studentcompanion-alu-chatbot.hf.space
                                 (used to build the redirect URI Google calls)
-    FRONTEND_URL                e.g. https://alustudentcompanion.vercel.app
+    FRONTEND_URL                e.g. https://chat.studentcompanionai.rw
     EMAIL_TOKEN_KEY             optional Fernet key; if set, refresh tokens are
                                 encrypted at rest in Aurora
 
@@ -62,7 +62,7 @@ BACKEND_PUBLIC_URL = os.environ.get(
     "BACKEND_PUBLIC_URL", "https://studentcompanion-alu-chatbot.hf.space"
 ).rstrip("/")
 FRONTEND_URL = os.environ.get(
-    "FRONTEND_URL", "https://alustudentcompanion.vercel.app"
+    "FRONTEND_URL", "https://chat.studentcompanionai.rw"
 ).rstrip("/")
 REDIRECT_URI = f"{BACKEND_PUBLIC_URL}/api/email/oauth/callback"
 

main.py

@@ -54,7 +54,8 @@ app.add_middleware(SlowAPIMiddleware)
 # admin dashboard); CORS_ALLOWED_ORIGINS (comma-separated) ADDS to these. "*"
 # is still honored but only as an explicit, credential-less opt-in for local dev.
 _DEFAULT_ORIGINS = [
-    "https://alu-student-companion.vercel.app",          # student PWA
+    "https://chat.studentcompanionai.rw",                # student PWA (production)
+    "https://alu-student-companion.vercel.app",          # student PWA (legacy)
     "https://v0-database-for-student-companion.vercel.app",  # admin dashboard (v0)
 ]
 _env_origins = [o.strip() for o in os.getenv("CORS_ALLOWED_ORIGINS", "").split(",") if o.strip()]