fix(security): restrict credentialed CORS to trusted frontend origins

[RachanaB5]

Fixes #733

Summary

This PR hardens backend CORS configuration by replacing wildcard credentialed CORS with an explicit, environment-driven origin allowlist.

Changes

• Added CORS_ALLOW_ORIGINS parsing to backend settings.
• Updated FastAPI CORS middleware to use configured origins.
• Prevented wildcard origins from being combined with credentialed CORS.
• Added regression tests for allowed origins, rejected origins, and wildcard credential handling.
• Documented the new environment variable in README, .env.example, and Render config.

Why This Matters

The API exposes authenticated endpoints such as /auth/me and /user/*. Allowing * origins with credentials creates an overly broad browser trust boundary and makes production deployments harder to secure.

This change keeps local development working while making production CORS explicit.

Testing

• Passed: python3 -m compileall backend/app/config.py backend/app/main.py backend/tests/test_endpoints.py
• Local pytest collection is blocked by missing native libmagic on this machine:
  ImportError: failed to find libmagic

The new tests should run in CI or any environment with the backend native dependencies installed.