with a cors issue like this, some clients will be able to zap, but some will not to demo the failure, you can set up a separate nostr account and attempt a zap from a web client like Yakhonne or Nostrudel