AllowedConnectOrigins had a sentry-ingest-origin placeholder that was simply incorrect - the Sentry tunnel exists precisely so that exception is never needed. Both SecurityHeaders fields are Umami-only now, with inline comments on when to set them versus leave them out, and a note that MasterModule__MasterUrl degrades to a warning rather than a startup failure when unset.