security: Replace CORS allow_origins=["*"] with env-var allowlist

Context

server-https/app.py:104 configures CORSMiddleware with allow_origins=["*"].

Problem

A wildcard origin lets any website make credentialed cross-origin requests to the API.

• This matters especially once PR #67's auth middleware lands —CORS and auth need to be hardened together to actually be effective.

Why This Order

Filed after the Kustomize restructure because the clean fix is injecting ALLOWED_ORIGINS as an env var patched per overlay — empty in base, localhost in generic, production domain in OCI. Doing it before Kustomize means hardcoding values.

Acceptance Criteria

• allow_origins read from ALLOWED_ORIGINS env var (comma-separated)
• Defaults to http://localhost:3000 when unset (dev-safe)
• Kustomize overlays patch the value per environment
• Requests from unlisted origins receive a proper CORS rejection

Related

• server-https/app.py:104
• PR #67 — auth middleware (CORS and auth go together)
• Parent tracking issue: #72
• Depends on: Kustomize issue (child A above)
• Blocks: auth hardening work (tracked in PR #67

Start with the CORS configuration at server-https/app.py:104, then inspect the Kustomize overlays and the related auth work in PR #67. Trace how environment values are supplied per overlay, and verify that unset, environment-specific, and unlisted-origin requests meet the acceptance criteria.