Restrict HTTP methods and headers with CORS

[fmell]

Restrict allowed CORS methods to: GET, POST, PUT, DELETE, OPTIONS
Restrict allowed CORS headers to: Authorization, Content-Type
Add fail-fast validation that raises on origin "*" when allow_credentials is true, as this will fail silently in the browser if misconfigured

[Copilot]

Pull request overview

This PR tightens the backend’s CORS configuration by explicitly allowing only the HTTP methods and request headers the frontend uses, and by adding a startup-time guard against an invalid credentialed CORS configuration (allow_credentials=True with allow_origins=["*"]).

Changes:

• Add fail-fast validation that raises if "*" is present in the configured CORS origins while credentials are enabled.
• Restrict CORS allowed methods to GET, POST, PUT, DELETE, OPTIONS (instead of "*").
• Restrict CORS allowed headers to Authorization and Content-Type (instead of "*").

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[lars-petter-hauge]

don't see a reason for not adding this, gogogo :)