Fix JS syntax errors and stage supabase-config CORS in CI

chat-widget.el: apostrophe in El native_js double-quoted strings caused
the El compiler to drop the backslash, producing broken JS single-quoted
strings. Switched those four string literals to double-quoted JS strings
using \" escaping so the compiled output is valid.

main.el: /api/supabase-config was returning 403 for all stage Cloud Run
origins. Added marketing-stage-* prefix to the allowed list so the
checkout page can initialise Supabase during CI E2E runs.

src/js/chat-widget.el

@@ -295,11 +295,11 @@ fn main() -> Void {
         session.messages.push({ role: 'ai', text: reply });
         saveSession(session);
       } else {
-        addMsg('ai', 'Hey. What\'s on your mind?', true);
+        addMsg('ai', \"Hey. What's on your mind?\", true);
       }
     })
     .catch(function() {
-      addMsg('ai', 'Hey. What\'s on your mind?', true);
+      addMsg('ai', \"Hey. What's on your mind?\", true);
     });
   }
 
@@ -532,7 +532,7 @@ fn main() -> Void {
           var ss   = secsLeft % 60;
           var pad  = function(n) { return n < 10 ? '0' + n : '' + n; };
           var ts   = hh > 0 ? (hh + ':' + pad(mm) + ':' + pad(ss)) : (pad(mm) + ':' + pad(ss));
-          return 'You\'ve had 10 conversations today. Come back in ' + ts + '.';
+          return \"You've had 10 conversations today. Come back in \" + ts + \".\";
         };
         addMsg('ai', _showRateTimer());
         // Update the last ai message with a live ticker
@@ -544,7 +544,7 @@ fn main() -> Void {
           if (lastAi) { lastAi.textContent = _showRateTimer(); }
           if (Math.floor(Date.now() / 1000) >= d.reset_at) {
             clearInterval(_timerInterval);
-            if (lastAi) { lastAi.textContent = 'You\'re all set — conversations reset. Say hello!'; }
+            if (lastAi) { lastAi.textContent = \"You're all set — conversations reset. Say hello!\"; }
             if (input)  { input.disabled = false; input.placeholder = 'Ask me anything...'; }
             if (btn)    { btn.disabled = false; }
           }

src/main.el

@@ -1172,6 +1172,7 @@ fn handle_request_inner(method: String, path: String, headers: Map, body: String
             || str_eq(req_origin, "https://www.neurontechnologies.ai")
             || str_starts_with(req_origin, "http://localhost:")
             || str_starts_with(req_origin, "http://127.0.0.1:")
+            || str_starts_with(req_origin, "https://marketing-stage-")
         if !origin_ok {
             return "{\"__status__\":403,\"error\":\"forbidden\"}"
         }