Configure CORS origins via environment variables

[DeFiVC]

What

CORS origins are hardcoded in src/server.ts rather than being configurable via environment variables.

Why

• Different environments (staging, production) may have different allowed origins
• Hardcoded values require code changes and redeployment for CORS updates
• Security best practice: configure allowed origins per deployment

Scope

Add CORS_ORIGINS environment variable support to the config.

Acceptance Criteria

• CORS_ORIGINS env var added to config schema
• Value is comma-separated list of origins
• Falls back to current defaults (localhost:3000 in dev, chainlearn.io in prod)
• No breaking changes to existing behavior

Technical Context

• Files: src/config/index.ts, src/server.ts (lines 77-83)
• Current behavior:
  • Production: [https://chainlearn.io]
  • Development: [http://localhost:3000]
• Pattern: Similar to chainlearn-indexer/.env.example ALLOWED_ORIGINS format