feat: complete CORS config-driven middleware rewrite

- cors.ts: createCorsMiddleware factory with RuntimeConfig param
  - Wildcard ['*'] mode: Access-Control-Allow-Origin: * (backward compatible)
  - Specific origins mode: reflect matching origin + Allow-Credentials
  - Added Access-Control-Max-Age: 86400 for preflight caching
- app.ts: accept config param, use createCorsMiddleware(config)
- index.ts: pass runtimeConfig to createApp
- env-overrides.ts: add string[] to RuntimeConfigValue, corsOriginsEnv helper
- runtime-config.ts: cors.allowedOrigins: string[] type
- defaults.ts: cors.allowedOrigins: ['*'] default
- .env: CORS_ALLOWED_ORIGINS=* with production example

apps/backend/src/app.ts

@@ -9,22 +9,24 @@ import tencentRouter from "./routes/tencent.js";
 import webhooksRouter from "./routes/webhooks.js";
 import { buildSuccessPayload, sendRouteError } from "./utils/http.js";
 import { accessLogMiddleware } from "./middleware/access-log.js";
-import { corsMiddleware } from "./middleware/cors.js";
+import { createCorsMiddleware } from "./middleware/cors.js";
+import type { RuntimeConfig } from "./types/runtime-config.js";
 import { buildHealthPayload, type StartupState } from "./startup/state.js";
-
 type CreateAppOptions = {
   startupState: StartupState;
   isShutdownStarted: () => boolean;
+  config: RuntimeConfig;
 };
 
 export function createApp({
   startupState,
   isShutdownStarted,
+  config,
 }: CreateAppOptions) {
   const app = express();
 
   app.use(accessLogMiddleware);
-  app.use(corsMiddleware);
+  app.use(createCorsMiddleware(config));
   app.use(express.json({ limit: "2mb" }));
   app.use(express.urlencoded({ extended: true }));