feat: add CORS support via CORS_ORIGINS env var

- New CORSMiddleware in server/cors.go
- Reads comma-separated origins from CORS_ORIGINS env
- Empty or "*" allows all origins
- Handles preflight OPTIONS requests
- Wraps existing LoggingMiddleware chain

server/server.go

@@ -48,7 +48,8 @@ func ParseMode(s string) (Mode, bool) {
 type AppConfig struct {
 	ConfigDir  string
 	ListenAddr string
-	MaxBackups int
+	MaxBackups   int
+	CORSOrigins []string
 }
 
 // Server is the main HTTP server.
@@ -73,7 +74,7 @@ func New(cfg AppConfig, auditLog *audit.Logger) *Server {
 
 	s.srv = &http.Server{
 		Addr:         cfg.ListenAddr,
-		Handler:      LoggingMiddleware(mux),
+		Handler:      CORSMiddleware(cfg.CORSOrigins, LoggingMiddleware(mux)),
 		ReadTimeout:  10 * time.Second,
 		WriteTimeout: 30 * time.Second,
 		IdleTimeout:  60 * time.Second,