Bug: CORS Misconfiguration Prevents Live Demo from Functioning

**Description**
Problem Summary:
The live demo of the application is not working because the backend server is rejecting API requests from the deployed frontend URL (https://travelagencyask.netlify.app). This is due to a Cross-Origin Resource Sharing (CORS) policy misconfiguration on the server that only permits requests from http://localhost:3000.

Steps to Reproduce:

- Navigate to the live frontend application at https://travelagencyask.netlify.app/tours.
- Open the browser's developer console (F12).
- Observe the network requests. You will see that API calls to https://travel-ageny-website.onrender.com/api/v1/tours are failing.

The console displays the following error:

Access to fetch at 'https://travel-ageny-website.onrender.com/api/v1/tours?page=0' from origin 'https://travelagencyask.netlify.app' has been blocked by CORS policy: The 'Access-Control-Allow-Origin' header has a value 'http://localhost:3000' that is not equal to the supplied origin.

**Expected Behavior:**
The live frontend should be able to successfully fetch data from the backend API, allowing the website to display tours and function correctly for users.

**Actual Behavior:**
All API requests from the live frontend are blocked by the browser due to the server's restrictive CORS policy. The website is therefore broken and cannot display any data from the API.

**Suggested Solution:**
The CORS configuration should be updated to include the deployed frontend's URL in the list of allowed origins. It's best practice to allow both the development (localhost) and production URLs.

This change will allow both the local development environment and the live production site to communicate with the API, fixing the issue for the demo.

I am GSSoC contributor ,Can you Assign this issue to me

Start at the backend API's CORS configuration and reproduce the failing request from https://travelagencyask.netlify.app/tours to the tours endpoint. Allow the deployed frontend while retaining local development access, then verify that the live page can fetch and display tours without the reported browser error.

Written by the indexing model from the issue text.