security(main.ts): CORS allows origin '*' together with credentials:true

[phertyameen]

Summary

backend/src/main.ts bootstraps CORS as:

app.enableCors({
  origin: '*',
  methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
  allowedHeaders: ['Content-Type', 'Authorization'],
  credentials: true,
});

Per the Fetch/CORS spec, Access-Control-Allow-Origin: * cannot be combined with credentialed requests - browsers reject such responses. Depending on how the underlying layer behaves, this means either (a) credentialed browser clients are broken, or (b) origins are effectively reflected, making every site trusted to send cookie/Authorization-bearing requests. Both outcomes are wrong.

Proposal

1. Move the allowlist to configuration: read CORS_ORIGINS (comma-separated) from env via the existing ConfigModule/app.config.ts.
2. Pass origin: <allowlist> and keep credentials: true only when the allowlist is non-wildcard.
3. Document the variable in docs/ENVIRONMENT.md (which already catalogs backend env vars).

Acceptance criteria

• Wildcard + credentials combo removed from the production path.
• Local development still works with a documented dev default (e.g. http://localhost:5173).
• Env var documented alongside the rest of the config surface.