The global @code/@cacheable matchers added Access-Control-Allow-Origin:* on top of the one the Express app (server.mjs) already sets on proxied responses, producing 'Access-Control-Allow-Origin: *, *' which browsers reject — breaking all cross-origin painting/image loads on laklok.com (and any non-AC origin). Use set-if-absent (?) so exactly one header is emitted. Same class of bug the IPFS block already documents.