I don't think this is possible currently with Digital Ocean.

My plan for a workaround is to create a function on the web app which acts as a proxy for the standalone function. That way I won't get CORS problems as the function the browser is calling is part of the app and on the same domain. The backend is not restricted by CORS as CORS is only for browsers, so it should be able to call my async standalone function without difficulty, and then report back to the static website.

It's a bit of a bodge but I don't see any other way forward. Once custom domains become a feature of standalone functions, things should be easier as then both the app and the function can be integrated into the same domain.