Portal B10: apply review learnings to CORS troubleshooting page

- Add sidebarTitle and keywords to frontmatter
- Link PORTAL_CORS_ENABLE, PORTAL_CORS_ALLOW_CREDENTIALS, and
  PORTAL_CORS_ALLOWED_ORIGINS in prose to their config reference anchors
- Replace em-dashes in all four accordion titles with restructured phrasing

Author: sharadregoti

portal/troubleshooting/cors-issues.mdx

@@ -1,12 +1,14 @@
 ---
 title: "Troubleshoot CORS Issues"
+sidebarTitle: "CORS Issues"
 description: "Diagnose and fix CORS errors in the Tyk Developer Portal and API Playground."
+keywords: "CORS, troubleshooting, Access-Control-Allow-Origin, API Playground, PORTAL_CORS_ENABLE, TT-15960"
 ---
 
 Cross-origin errors in the Developer Portal arise from two independent layers: the Portal application itself and the Tyk Gateway APIs that the API Playground calls directly. Identify which layer is failing before applying a fix.
 
 <AccordionGroup>
-  <Accordion title="Browser blocks responses from the Portal — Access-Control-Allow-Origin header missing">
+  <Accordion title="Access-Control-Allow-Origin header missing from Portal responses">
     **Symptom**
 
     Requests from your application to the Portal Admin API or Live Portal routes fail. The browser console shows:
@@ -19,14 +21,14 @@ Cross-origin errors in the Developer Portal arise from two independent layers: t
 
     **Cause**
 
-    `PORTAL_CORS_ENABLE` is `false` (the default). The Portal's CORS middleware is disabled, so no `Access-Control-Allow-Origin` header is added to any response and `OPTIONS` preflight requests fall through to the router with no matching handler.
+    [PORTAL_CORS_ENABLE](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal-cors-enable) is `false` (the default). The Portal's CORS middleware is disabled, so no `Access-Control-Allow-Origin` header is added to any response and `OPTIONS` preflight requests fall through to the router with no matching handler.
 
     **Fix**
 
     Enable Portal CORS and set your allowed origins. See [Configure Portal Application CORS](/portal/how-to-guides/configure-cors#configure-portal-application-cors).
   </Accordion>
 
-  <Accordion title="API Playground requests fail — 401 Unauthorized or missing CORS headers from Gateway">
+  <Accordion title="API Playground requests fail with 401 Unauthorized or missing CORS headers">
     **Symptom**
 
     Test requests in the API Playground fail. The browser console shows one of:
@@ -46,7 +48,7 @@ Cross-origin errors in the Developer Portal arise from two independent layers: t
     Configure CORS on the API definition and add your Portal URL to the allowed origins. See [Configure Gateway CORS for APIs](/portal/how-to-guides/configure-cors#configure-gateway-cors-for-apis).
   </Accordion>
 
-  <Accordion title="403 Forbidden on OPTIONS preflight — Gateway v5.8.6–v5.8.13 regression (TT-15960)">
+  <Accordion title="403 Forbidden on OPTIONS preflight in Gateway v5.8.6–v5.8.13 (TT-15960)">
     **Symptom**
 
     API Playground requests fail on Gateway versions v5.8.6 through v5.8.13, even when CORS is correctly configured and the Portal origin is in `allowed_origins`. The browser console shows:
@@ -74,7 +76,7 @@ Cross-origin errors in the Developer Portal arise from two independent layers: t
     Upgrade Tyk Gateway to v5.8.14 or later, where the middleware ordering is corrected.
   </Accordion>
 
-  <Accordion title="Browser CORS error — credentials rejected with wildcard origin">
+  <Accordion title="CORS error: wildcard origin rejected when credentials are enabled">
     **Symptom**
 
     Credentialed cross-origin requests to the Portal fail. The browser console shows:
@@ -85,7 +87,7 @@ Cross-origin errors in the Developer Portal arise from two independent layers: t
 
     **Cause**
 
-    `PORTAL_CORS_ALLOW_CREDENTIALS=true` is set alongside `PORTAL_CORS_ALLOWED_ORIGINS=*`. The Portal's CORS library (`rs/cors`) does not reject this combination at startup — it returns both `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true` in the response. The CORS specification forbids this combination, so the browser rejects the response.
+    [PORTAL_CORS_ALLOW_CREDENTIALS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal-cors-allow-credentials)=true is set alongside [PORTAL_CORS_ALLOWED_ORIGINS](/product-stack/tyk-enterprise-developer-portal/deploy/configuration#portal-cors-allowed-origins)=*. The Portal's CORS library (`rs/cors`) does not reject this combination at startup — it returns both `Access-Control-Allow-Origin: *` and `Access-Control-Allow-Credentials: true` in the response. The CORS specification forbids this combination, so the browser rejects the response.
 
     **Fix**