fix: remove the pickup and invoice notes from checkout; document R2 CORS

The pickup notice under the delivery options and the invoice and retention
note under the purchase summary are gone. PORTAINER.md records the R2 CORS
policy the browser's direct uploads need: without it the preflight is
refused and checkout fails with a NetworkError before payment.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/PORTAINER.md

@@ -93,6 +93,24 @@ as `dtf_prod_database_url_v1`, then place only those names in the corresponding
 Credential values must never be entered into Git, `portainer.env`, or Gitea
 workflow variables.
 
+**R2 CORS.** The Site uploads artwork straight from the browser to the bucket
+with presigned `PUT` requests, so the bucket must allow the Site's origin.
+Without it the preflight is refused (403) and the Site shows "NetworkError
+when attempting to fetch resource" at checkout (found 2026-09-28). In the
+Cloudflare dashboard, R2 → the bucket → Settings → CORS policy:
+
+```json
+[
+  {
+    "AllowedOrigins": ["https://<SITE_DOMAIN>", "https://<KANBAN_DOMAIN>"],
+    "AllowedMethods": ["PUT", "GET", "HEAD"],
+    "AllowedHeaders": ["content-type"],
+    "ExposeHeaders": ["ETag"],
+    "MaxAgeSeconds": 3600
+  }
+]
+```
+
 ## 3. Create the stack once
 
 In Portainer select **Stacks → Add stack → Git repository**: