feat: add Cors config and origins #109

[jfernsio]

What was done

• Added support for CORS_ALLOWED_ORIGINS environment variable to configure multiple allowed origins for CORS (comma-separated). Improved production security with a safe default.
• fixes (Add CORS configuration via env #109 )

Changes

• Updated CORS configuration to read CORS_ALLOWED_ORIGINS (new) and fall back to legacy CORS_ORIGIN
• In production, if no origins are configured, CORS now safely defaults to deny-all (no Access-Control-Allow-Origin header)
• In development, defaults to http://localhost:5173 when nothing is set
• Updated README.md with clear documentation for the new env var and behavior
• Added tests to verify allowed origins work, unauthorized origins are rejected, and production default is secure

[vercel]

@jfernsio is attempting to deploy a commit to the joelpeace48-cell's projects Team on Vercel.

A member of the Team first needs to authorize it.