feat: complete CORS config-driven middleware rewrite

- cors.ts: createCorsMiddleware factory with RuntimeConfig param
  - Wildcard ['*'] mode: Access-Control-Allow-Origin: * (backward compatible)
  - Specific origins mode: reflect matching origin + Allow-Credentials
  - Added Access-Control-Max-Age: 86400 for preflight caching
- app.ts: accept config param, use createCorsMiddleware(config)
- index.ts: pass runtimeConfig to createApp
- env-overrides.ts: add string[] to RuntimeConfigValue, corsOriginsEnv helper
- runtime-config.ts: cors.allowedOrigins: string[] type
- defaults.ts: cors.allowedOrigins: ['*'] default
- .env: CORS_ALLOWED_ORIGINS=* with production example

apps/backend/src/index.ts

@@ -20,10 +20,10 @@ try {
   logError("[startup]", "运行时配置校验失败，服务停止启动", error);
   process.exit(1);
 }
-
 const app = createApp({
   startupState,
   isShutdownStarted: () => shutdownController?.isShutdownStarted() || false,
+  config: runtimeConfig,
 });
 
 const server = app.listen(port, host, () => {