Added CORS allow list

[DokaIzk]

• Add CORS_ALLOWED_ORIGINS environment variable for configuring trusted frontend origins
• Parse comma-separated origins with proper trimming and filtering
• Replace permissive CORS behavior with restricted allowlist configuration
• Default to http://localhost:5173 for local development (Vite frontend)
• Support multiple production origins via environment configuration
• Unauthorized origins will now be rejected by CORS middleware

closes: #24

[drips-wave]

@DokaIzk Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[vercel]

@DokaIzk is attempting to deploy a commit to the ritik4ever's projects Team on Vercel.

A member of the Team first needs to authorize it.

[DokaIzk]

@ritik4ever kindly awaiting your review