feat(security): CORS middleware with configurable origins

[MarkCesium]

Summary

No CORSMiddleware. If the frontend ever moves to a different origin (separate CDN, mobile wrapper, staging subdomain), every XHR breaks.

Changes

• backend/gateway/src/main.py:

  app.add_middleware(
      CORSMiddleware,
      allow_origins=settings.cors_origins,
      allow_credentials=True,
      allow_methods=["*"],
      allow_headers=["*"],
  )

• settings.cors_origins from GATEWAY__CORS_ORIGINS (comma-separated). Default empty (same-origin only).

Verification

• With GATEWAY__CORS_ORIGINS=https://app.example.com, an OPTIONS preflight returns correct Access-Control-Allow-Origin.
• Unlisted origin preflight is rejected.