feat(cors): implement environment-based CORS allowlist middleware

[GideonBature]

This PR:

• Add CORS_ORIGINS environment variable with documentation in .env.example
• Introduce cors.middleware.ts with environment-aware CORS configuration
• Allow all origins in development with credentials support
• Allow wildcard origin in test environment for easier testing
• Enforce strict allowlist checking in production with wildcard and subdomain support
• Replace default cors() usage in app.ts with the new corsMiddleware
• Add comprehensive unit tests for all environments and edge cases
• Log warnings for missing or blocked origins in production
• Expose X-Request-ID header for tracing and set max age to 24 hours

Closes #301

[drips-wave]

@GideonBature Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits