fix(server): allow server.headers to override server.cors

[chenjiahan]

Summary

Allow server.headers to override server.cors. This ensures that fields explicitly defined in server.headers always work as expected.

Checklist

• Tests updated (or not required).
• Documentation updated (or not required).

[netlify]

✅ Deploy Preview for rsbuild ready!

Name	Link
🔨 Latest commit	46e351e
🔍 Latest deploy log	https://app.netlify.com/sites/rsbuild/deploys/67e5ebb2b1595000086136d2
😎 Deploy Preview	https://deploy-preview-4898--rsbuild.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.
Lighthouse	1 paths audited Performance: 80 (🟢 up 21 from production) Accessibility: 97 (no change from production) Best Practices: 100 (no change from production) SEO: 100 (no change from production) PWA: 60 (no change from production) View the detailed breakdown and full score reports

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[Copilot]

Pull Request Overview

This PR updates the server configuration so that user-defined server.headers take precedence over server.cors.

• Moved the header-setting middleware to execute after the CORS middleware in both the production and development server setups.
• Updated tests to confirm that server.headers override server.cors, and adjusted proxy tests accordingly.

Reviewed Changes

Copilot reviewed 4 out of 6 changed files in this pull request and generated no comments.

File	Description
packages/core/src/server/prodServer.ts	Reordered header middleware to run after CORS middleware.
packages/core/src/server/devMiddlewares.ts	Updated middleware order to ensure header override behavior.
e2e/cases/server/proxy/index.test.ts	Changed test config for proxy server from headers to cors.
e2e/cases/server/cors/index.test.ts	Added tests to validate that headers override CORS in both dev and preview servers.

Files not reviewed (2)

• website/docs/en/config/server/headers.mdx: Language not supported
• website/docs/zh/config/server/headers.mdx: Language not supported

Comments suppressed due to low confidence (1)

packages/core/src/server/devMiddlewares.ts:104

• [nitpick] Inconsistent backtick usage in the comment; consider formatting both server.headers and server.cors consistently.

// server.headers` can override `server.cors`