- cors_restrictive/cors_api return Result; invalid origins are typed
  startup errors (CorsError::InvalidOrigin), not panics on caller input
- empty origin list = CorsError::NoOrigins (was: silent allow-all)
- default_middleware_stack drops the permissive CORS layer; CORS is
  opt-in via middleware_stack_with_cors