Feature: Add CORS configuration documentation and validation #82
Description
Problem
CORS is enabled via cors() in api/src/app.ts with default settings (allows all origins). No documentation on how to restrict origins for production.
Context
Allowing all origins in production is a security risk. Production should only allow specific frontend domains.
Proposed Solution
- Make CORS origins configurable via env var
- Default to restrictive in production
- Document CORS configuration in README
Acceptance Criteria
- CORS origins configurable via
ALLOWED_ORIGINSenv var - Default: allow all in development, restrict in production
- Documentation updated
- Tests verify CORS headers
Technical Notes
- File:
api/src/app.ts(CORS setup)
Constraints
- Must support multiple origins (comma-separated list)