The two fields had been flipped, pointing API calls at the origin host (platform.savefamily.app) and sending the Origin header as the gateway host (api-platform.savefamily.app). Restore the intended wiring: gateway handles /api, and Origin is the platform domain.