{# Served from the CDN like the icons it references. A cross-origin
manifest is fetched in CORS mode and crossorigin sets the credentials
mode; the bucket answers access-control-allow-origin: *. Filenames are
stable and the CDN caches them for 24h, so a brand rename or domain
change needs render_web_app_manifests + collectstatic + a targeted CDN
purge of the changed file. Rendered by
portal/management/commands/render_web_app_manifests.py. #}