Configure the Content Security Policy and CORS for the API

### Objetvie
Configure CSP and CORS headers in the API

### Context
A basic configuration of the CORS(Cross-Origin Resource Sharing) in the API to allow the future frontend website connect easily and the CSP(Content Security Policy) to avoid XSS(Cross-Site Scripting) attacks and trust only in that comes from the own domain the API or the frontend

### Checklist
- [ ] Create an spec with OpenSpec to build the CSP and CORS headers in the API

The issue names no files, tests, or API entry points. Start by locating the API configuration and existing security-header conventions, then write the requested OpenSpec specification defining the CSP and CORS behavior; done means the specification clearly covers the API and future frontend connection.

Written by the indexing model from the issue text.