fix(infra): add staking app domains to SIWE allowlists (#926)

The ID Staking App (stake.passport.xyz) uses /ceramic-cache/authenticate
and /account/nonce endpoints which require SIWE domain validation added
in #923. Add stake.{domain} to both SIWE_ALLOWED_DOMAINS_CERAMIC_CACHE
and SIWE_ALLOWED_DOMAINS_ACCOUNT in both infra configs (main API and
app_api lambdas).

Co-authored-by: Claude Code <noreply@anthropic.com>

Author: human-dot-bot[bot]

infra/aws/app_api/index.ts

@@ -49,19 +49,21 @@ export function createAppApiLambdaFunctions(config: {
     {
       name: "SIWE_ALLOWED_DOMAINS_CERAMIC_CACHE",
       value: config.passportXyzDomainName.apply((d) => {
-        const domains = [`app.${d}`];
+        const domains = [`app.${d}`, `stake.${d}`];
         if (d.startsWith("production.")) {
-          domains.push(`app.${d.replace("production.", "")}`);
+          const envLess = d.replace("production.", "");
+          domains.push(`app.${envLess}`, `stake.${envLess}`);
         }
         return JSON.stringify(domains);
       }),
     },
     {
       name: "SIWE_ALLOWED_DOMAINS_ACCOUNT",
       value: config.passportXyzDomainName.apply((d) => {
-        const domains = [`developer.${d}`];
+        const domains = [`developer.${d}`, `stake.${d}`];
         if (d.startsWith("production.")) {
-          domains.push(`developer.${d.replace("production.", "")}`);
+          const envLess = d.replace("production.", "");
+          domains.push(`developer.${envLess}`, `stake.${envLess}`);
         }
         return JSON.stringify(domains);
       }),

infra/aws/index.ts

@@ -816,20 +816,22 @@ const apiEnvironment = [
   {
     name: "SIWE_ALLOWED_DOMAINS_CERAMIC_CACHE",
     value: passportXyzDomainName.apply((d) => {
-      const domains = [`app.${d}`];
+      const domains = [`app.${d}`, `stake.${d}`];
       // Production users visit app.passport.xyz (no "production" subdomain)
       if (d.startsWith("production.")) {
-        domains.push(`app.${d.replace("production.", "")}`);
+        const envLess = d.replace("production.", "");
+        domains.push(`app.${envLess}`, `stake.${envLess}`);
       }
       return JSON.stringify(domains);
     }),
   },
   {
     name: "SIWE_ALLOWED_DOMAINS_ACCOUNT",
     value: passportXyzDomainName.apply((d) => {
-      const domains = [`developer.${d}`];
+      const domains = [`developer.${d}`, `stake.${d}`];
       if (d.startsWith("production.")) {
-        domains.push(`developer.${d.replace("production.", "")}`);
+        const envLess = d.replace("production.", "");
+        domains.push(`developer.${envLess}`, `stake.${envLess}`);
       }
       return JSON.stringify(domains);
     }),