Harden CORS by enforcing explicit origin allowlist

[heliosran]

Motivation

• Prevent using a wildcard origin together with credentials and reduce the CORS attack surface by requiring explicit allowlisting of trusted origins.

Description

• Replace wildcard origin: "*" CORS behavior with an explicit allowlist driven by the ALLOWED_ORIGINS environment variable and exact-origin matching in src/index.ts.
• Only return Access-Control-Allow-Credentials: true when the request Origin is explicitly allowlisted and set minimal preflight surface: allowed methods POST, GET, OPTIONS and headers Content-Type, Authorization.
• Add ALLOWED_ORIGINS?: string to the Env type in src/types.ts and document the configuration in README.md and .dev.vars.example.
• Add unit tests (test/index.spec.ts) covering preflight and regular-response CORS headers for allowed and disallowed origins, and update vitest.config.mts to use wrangler.toml for the test pool.

Testing

• Ran TypeScript check with npm run tsc and it succeeded.
• Ran linter with npm run lint and it succeeded.
• Ran tests with npm run test -- --run; the initial test run surfaced a missing wrangler.jsonc config (failure), then after updating the vitest config to point to wrangler.toml the test suite passed: 4 tests (all passed).

---

Codex Task