CORS policy: Response to preflight request doesn't pass access control check

Puter selfhosted，In **Dev Center**, when uploading project files through:

`Apps -> Deploy -> Use files`

the following CORS error occurs:

```bash
Access to XMLHttpRequest at 'https://s3.bhhaihuan.com/puter-local/df9ad496-acad-4c06-b59c-693edc4e6bdc?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Content-Sha256=UNSIGNED-PAYLOAD&X-Amz-Credential=puter%2F20260703%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20260703T034526Z&X-Amz-Expires=900&X-Amz-Signature=2d8fae0964a6872535438ad5321e5eda71752e8041bd701f7f4310fbadc24976&X-Amz-SignedHeaders=host&x-amz-checksum-crc32=AAAAAA%3D%3D&x-amz-sdk-checksum-algorithm=CRC32&x-id=PutObject' from origin 'https://bhhaihuan.com' has been blocked by CORS policy: Response to preflight request doesn't pass access control check: No 'Access-Control-Allow-Origin' header is present on the requested resource.
```

The issue can be fixed by applying the following configuration:

```bash
cd ~puter/puter-selfhosted
```

Configure **bucket-level CORS** with restricted origins instead of using `*`:

```bash
S3_SECRET=$(grep S3_SECRET_KEY .env | cut -d= -f2)

docker compose run --rm \
-e AWS_ACCESS_KEY_ID=puter \
-e AWS_SECRET_ACCESS_KEY="$S3_SECRET" \
-e AWS_DEFAULT_REGION=us-east-1 \
--entrypoint /bin/sh s3-init -c '
cat > /tmp/cors.json <