Feature: Add CORS configuration documentation and validation

[Smartdevs17]

Problem

CORS is enabled via cors() in api/src/app.ts with default settings (allows all origins). No documentation on how to restrict origins for production.

Context

Allowing all origins in production is a security risk. Production should only allow specific frontend domains.

Proposed Solution

1. Make CORS origins configurable via env var
2. Default to restrictive in production
3. Document CORS configuration in README

Acceptance Criteria

• CORS origins configurable via ALLOWED_ORIGINS env var
• Default: allow all in development, restrict in production
• Documentation updated
• Tests verify CORS headers

Technical Notes

• File: api/src/app.ts (CORS setup)

Constraints

• Must support multiple origins (comma-separated list)

[drips-wave]

This issue has been added to the Stellar Wave Program and is worth 100 Points.

🧑‍💻 Interested in contributing? Apply to work on this issue on Drips Wave, earn points, and receive rewards.

Warning

Only applications submitted via the apply link above will be considered. Please do not apply by commenting on the issue or opening a PR directly.

🤠 Repo maintainers: You can manage this issue's Points and Complexity on your Maintainer Dashboard here. Please keep an eye on applications and respond quickly 💙

ℹ️ Learn more about Drips Wave