CORS allowlist regex is unanchored (vercel preview pattern)

## Summary
`src/server.ts:53` — the CORS origin regex `/https:\/\/([a-zA-Z0-9\-_])+-decentraland1\.vercel\.app/` lacks an end anchor (`$`). Verified: `Origin: https://example-decentraland1.vercel.app.attacker.com` matches, so an attacker-controlled origin is treated as allowed.

## Impact
Cross-origin reads of the events API from attacker origins. Limited today because the events API does not use cookie-based auth (signed-fetch headers are not auto-attached cross-origin), so it mainly exposes public data — but the allowlist is unsound.

## Fix
Anchor the regex (`^...$`).