Enforce configured CORS origin allowlist

Follow-up slice of #227.

Replace the permissive credentialed CORS configuration with the existing configured CORS origin allowlist.

Scope:
- use the runtime CORS_ORIGINS configuration for credentialed browser requests;
- add focused tests for an allowed origin, a rejected origin, and same-origin/no-Origin behavior;
- keep local Compose defaults and production environment examples aligned.

Acceptance criteria:
- unknown cross-origin requests do not receive credentialed CORS permission;
- known development and production origins continue to work;
- no email-related behavior is added or changed.

Production configuration validation remains part of #176.

Locate the runtime CORS handling and the CORS_ORIGINS configuration, then inspect the local Compose defaults and production environment examples. Add focused coverage for allowed, rejected, and same-origin/no-Origin requests. Done means unknown cross-origin requests receive no credentialed permission while configured development and production origins continue to work, without changing email behavior.

Scritto dal modello di indicizzazione a partire dal testo della issue.