feat: scoped CORS config, requirements.txt and verification tests

[madsysharma]

Summary

Closes #11

This feature enables CORS for the Flask backend so the frontend (served from a different origin in dev - Live Server on :5500, or file://) can call /chat.

Scope was limited to issue #11; the chat handler itself is unchanged aside from a logger nit.

Changes

• backend/app.py — replaced the bare CORS(app) with a scoped config:
  • Limited to /chat and /health
  • Methods restricted to GET, POST, OPTIONS
  • Allowed origins default to common local-dev origins (incl. "null" for file://); override via the CORS_ALLOWED_ORIGINS environment variable
  • Pre-flight cached for 1 day (max_age=86400)
• backend/app.py — added GET /health returning {"status": "ok"} for cheap end-to-end verification (no OpenAI tokens spent).
• backend/requirements.txt — added (pins flask, flask-cors, openai, python-dotenv). flask-cors was previously imported but not listed anywhere, so contributors couldn't reproduce the env from the README.
• backend/.env.example — added, records OPENAI_API_KEY and CORS_ALLOWED_ORIGINS.
• backend/tests/ — added pytest suite covering pre-flight from allowed origin, POST with ACAO header, disallowed origin/s not getting ACAO, /health reachability, and the 400 path. OpenAI is mocked so that tests run offline.
• README.md — updated setup steps to use requirements.txt and documented the verification curl commands.

Verification

End-to-end, against a local run with Origin: http://127.0.0.1:5500:

• GET /health -> 200, Access-Control-Allow-Origin: http://127.0.0.1:5500
• OPTIONS /chat (preflight) -> 200, ACAO/ACAM/ACAH headers present
• OPTIONS /chat from http://evil.example.com -> no ACAO header (browser will block it, as intended)

Tests pass locally: pytest backend/tests -q -> 5 passed.

Notes for review

The default origin list includes "null" because index.html is sometimes opened directly off disk during dev - without this, the chatbot's fetch request to /chat fails pre-flight. If that's undesirable for prod, drop it from CORS_ALLOWED_ORIGINS in the production .env.

[madsysharma]

Hi @AditixAnand , please review this PR. Also, could you please add the "gssoc:approved" label to this? Thank you.

[madsysharma]

Hi @AditixAnand , please review this PR when you find the time to. Also, could you please add the "gssoc:approved" label to this? Thank you.

[madsysharma]

Hi @AditixAnand , please review this PR. Thank you.