feat: add CORS management to bucket provisioner plugin

[pyramation]

Summary

Adds CORS management to the graphile-bucket-provisioner-plugin and @constructive-io/bucket-provisioner packages.

Plugin changes (graphile-bucket-provisioner-plugin):

• CORS update hook — wraps update* mutations on @storageBuckets-tagged tables to detect allowed_origins changes and call updateCors() on the S3 bucket
• 3-tier CORS resolution: bucket-level allowed_origins → storage_module-level allowed_origins → plugin config allowedOrigins
• Wildcard CORS (['*']) for CDN/public bucket deployments
• Reads allowed_origins from both the bucket row and storage_module table
• provisionBucket explicit mutation now passes bucket-level allowed_origins through the hierarchy
• README updated to document CORS features, update hook, and 3-tier resolution

Library changes (@constructive-io/bucket-provisioner):

• provision() now accepts optional allowedOrigins per-call override (falls back to provisioner default)
• New updateCors() method for CORS-only updates without full re-provisioning
• New UpdateCorsOptions type exported

Test coverage: 54 plugin tests (8 new CORS tests) + 84 bucket-provisioner tests passing.

Updates since last revision

• Preset integration — BucketProvisionerPreset is now wired into ConstructivePreset in graphile-settings, following the same lazy-init pattern as presigned-url-resolver.ts
• New bucket-provisioner-resolver.ts — reads CDN config via getEnvOptions() (merges pgpmDefaults → config file → env vars), caches on first call
• Schema snapshot updated — provisionBucket mutation, ProvisionBucketInput, and ProvisionBucketPayload now appear in the GraphQL SDL snapshot
• JSDoc examples updated — preset.ts and index.ts examples now show getEnvOptions() pattern instead of raw process.env

Review & Testing Checklist for Human

• Update mutation input shape — The update hook extracts allowed_origins from bucketInput directly (not from a patch sub-object). Verify this matches how PostGraphile v5 actually structures update* mutation inputs. If PG5 uses { nodeId, patch: { allowed_origins } }, the detection at 'allowed_origins' in bucketInput will miss it. This is the highest-risk item.
• Bucket key extraction on update — The update path reads bucketInput?.key to look up the bucket row post-update. Confirm this is where PG5 puts the row identifier in update mutation args. If PG5 uses nodeId instead, the CORS update will silently skip with a warning.
• Preset wiring CDN config — bucket-provisioner-resolver.ts reads cdn from getEnvOptions() and destructures awsAccessKey, awsSecretKey, etc. Verify these fields are always populated by pgpmDefaults so the resolver doesn't throw on first call in environments without explicit CDN env vars.
• Verify CORS hierarchy in real DB scenario — Unit tests mock the DB queries; confirm the allowed_origins column is actually returned by the SQL queries against real storage_module and buckets tables (depends on companion PR constructive-db#756).

Suggested test plan: Deploy with a test database that has the allowed_origins columns (from constructive-db#756), create a bucket with specific allowed_origins, and verify the S3 bucket gets the correct CORS config. Then update allowed_origins and confirm the S3 CORS is re-applied. Also verify that provisionBucket mutation appears in the schema when running against ConstructivePreset.

Notes

• Companion schema PR: constructive-db#756 adds allowed_origins to storage_module table and buckets table generator
• Depends on PR #962 (base bucket provisioner plugin) — merge feat: add graphile-bucket-provisioner-plugin + wire into ConstructivePreset #962 first, then this PR
• pnpm-lock.yaml has unrelated @types/node version resolution drift (22.19.15 → 25.5.0) — this is lock file churn, not an intentional change

Link to Devin session: https://app.devin.ai/sessions/4c882ba2dfbf4045adf85fb83cde6f77
Requested by: @pyramation

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring