Align TinyPen timeout and CORS defaults for contract stability

Deep seam scan found a reliability/security drift worth standardizing.`n`nFindings:`n- TinyPen defaults `RERUM_FETCH_TIMEOUT_MS=30000` for upstream RERUM calls.`n- CORS behavior may allow broad origins in some env modes (OPEN_API_CORS path), while adjacent services enforce stricter allowlists.`n`nRequested adjustment:`n1. Document timeout policy and expose explicit env knobs for all outbound calls.`n2. Align CORS defaults with least-privilege allowlist behavior across environments.`n3. Add startup logging that prints effective timeout + CORS policy to ease ops verification.`n`nFiled from contract seam scan; label: copilot.