Fix CORS preflight: Always return 200 JSON + correct headers for OPTIONS requests

### Problem
Some frontend requests fail silently due to CORS preflight (OPTIONS) requests not returning CORS-safe JSON & headers.

When the browser sends an OPTIONS preflight, the backend does not respond with:
- 200 OK
- correct `Access-Control-*` headers
- JSON response

As a result, the browser blocks the real request before it hits the route.

### Reproduction

1. Make a cross-origin POST request from the frontend with Authorization header
2. Observe OPTIONS preflight request
3. Browser blocks request due to missing CORS-safe response

### Proposed Fix

Add a CORS middleware so that:
1. OPTIONS requests always respond with `200 OK`, JSON content, and required CORS headers
2. All routes include `Access-Control-Allow-Origin`, `Access-Control-Allow-Methods`, and `Access-Control-Allow-Headers` in responses

### Acceptance Criteria

- OPTIONS requests return HTTP 200
- Response includes valid CORS headers
- Response body is valid JSON
- Frontend requests no longer fail at preflight stage

### Benefits

- avoids silent CORS failures in browsers
- improves developer experience
- infra-level fix with no feature logic changes

Happy to submit a PR for this if the approach looks good.

Start by locating the TypeScript backend request entry point and its existing middleware, then inspect how OPTIONS requests and CORS headers are currently handled. Verify the behavior with an OPTIONS preflight for an authenticated cross-origin POST; done means a 200 response with valid JSON and the required CORS headers, plus those headers on other routes.

Written by the indexing model from the issue text.