Setup CORS for Extension

[hayesZach]

Note

Medium Risk
Introduces new CORS allowlist logic (including optional Firefox extension support) that directly affects cross-origin access to user endpoints; misconfiguration could unintentionally block or allow requests.

Overview
Adds configurable CORS handling to the HTTP server using go-chi/cors, driven by new config fields HTTP.AllowedOrigins and HTTP.AllowFirefoxExtensions.

Requests are now only allowed from explicitly configured origins, with an optional mode to permit moz-extension://... origins only when calling /api/v1/users/*; CORS is restricted to GET/OPTIONS with credentials enabled.

^{Written by Cursor Bugbot for commit 16683bc. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}