Fix browser CORS for Space authentication

[haileyok]

Summary

• Fix browser CORS responses so Space/OAuth clients can send Authorization and DPoP headers during credential exchange.
• Keep Cocoon’s intentionally open cross-origin policy while making credentialed browser requests standards-compliant.

Changes

• Reflect the requesting origin instead of combining * with credentials.
• Explicitly allow Authorization, DPoP, content negotiation, atproto-proxy, and standard HTTP methods.
• Expose DPoP-Nonce and WWW-Authenticate for browser DPoP retry handling.
• Add a regression test covering the Space credential-exchange preflight.

Validation

• go test ./... -count=1
• go vet ./...
• go test -race ./... -count=1
• git diff --check

Review notes

• This is a follow-up to merged PR Accept nonce-bearing Space DPoP proofs #129; the live server must be rebuilt and deployed before browser clients can retry.
• The change addresses the observed invalid Authorization header CORS interoperability failure; it does not create missing Spaces automatically.