CORS issue for Hobby/Self-hosted

Bug Description

After deploying a copy of a self-hosted/hobby install and setting up the JS snippet correctly, I see the following JS console errors:

Access to fetch at 'https://posthog.example.com/i/v0/e/?retry_count=1&ip=1&_=1746582443868&ver=1.240.0&compression=gzip-js' from origin 'https://example.com' has been blocked by CORS policy: No 'Access-Control-Allow-Origin' header is present on the requested resource.
(index):208 

POST https://posthog.example.com/i/v0/e/?retry_count=1&ip=1&_=1746582443868&ver=1.240.0&compression=gzip-js net::ERR_FAILED 403 (Forbidden)

I've made sure to set the domain where the JS snippet is installed as an authorized domain under the Web Analytics settings. I see this both on localhost as well as on my live domain. The errors log repeatedly even with no interaction by the user, like scrolling or clicking.

What could be going wrong?

I am running the latest docker image for hobby installs

Debug info

- [ ] PostHog Cloud, Debug information: [please copy/paste from https://us.posthog.com/settings/project-details#variables or https://eu.posthog.com/settings/project-details#variables]
- [X] PostHog Hobby self-hosted with `docker compose`, version/commit: [please provide]
- [ ] PostHog self-hosted with Kubernetes (deprecated, see [`Sunsetting Kubernetes support`](https://posthog.com/blog/sunsetting-helm-support-posthog)), version/commit: [please provide]

Start by reproducing the browser request against the self-hosted /i/v0/e/ endpoint and inspect how CORS and authorized Web Analytics domains are configured. Compare the response for localhost and the live domain, including the 403 status and missing Access-Control-Allow-Origin header. Done means authorized origins can send events without repeated CORS or 403 errors.