Two config keys were silently ignored by drasl (logged as "unknown config
option"), so neither took effect in production:
- `DefaultAdminUsernames` is not a drasl option; the correct top-level key is
`DefaultAdmins`. With the wrong key, the `admin` user never got promoted —
admin-only API routes (e.g. GET /players for the registered-players roster)
returned 403.
- `CORSAllowOrigins` sat after the `[RegistrationNewPlayer]` table header, so
TOML parsed it as `RegistrationNewPlayer.CORSAllowOrigins` (ignored → no CORS
headers → landing register/account browser calls blocked). Moved it top-level,
before any [Section], with a comment warning against re-nesting.
Verified against drasl master configuration.md.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Oier Bravo Urtasun
97347693b6