Enforce configured CORS origin allowlist

Follow-up slice of #227.

Replace the permissive credentialed CORS configuration with the existing configured CORS origin allowlist.

Scope:
- use the runtime CORS_ORIGINS configuration for credentialed browser requests;
- add focused tests for an allowed origin, a rejected origin, and same-origin/no-Origin behavior;
- keep local Compose defaults and production environment examples aligned.

Acceptance criteria:
- unknown cross-origin requests do not receive credentialed CORS permission;
- known development and production origins continue to work;
- no email-related behavior is added or changed.

Production configuration validation remains part of #176.