- Add CORS_ORIGINS environment variable with documentation in .env.example
- Introduce cors.middleware.ts with environment-aware CORS configuration
- Allow all origins in development with credentials support
- Allow wildcard origin in test environment for easier testing
- Enforce strict allowlist checking in production with wildcard and subdomain support
- Replace default cors() usage in app.ts with the new corsMiddleware
- Add comprehensive unit tests for all environments and edge cases
- Log warnings for missing or blocked origins in production
- Expose X-Request-ID header for tracing and set max age to 24 hours