feat(backend): add CORS middleware with whitelisted dashboard origins(#740)

[MerlinTheWhiz]

Summary

Closes #740 — restricts cross-origin requests to the configured frontend dashboard domains by adding a whitelisted Tower CORS middleware layer to the Axum app.

Changes

• backend/src/config.rs: parse comma-separated CORS_ALLOWED_ORIGINS into Config::cors_allowed_origins (entries trimmed, empties dropped). Falls back to http://localhost:3000 with a tracing::warn! when unset so local dev keeps working.
• backend/src/main.rs: new cors_layer() builder applied to the top-level router, covering public, auth, admin, and protected routes:
  • allow_origin(...) — whitelist from config; unparseable origins are logged and skipped (no startup panic)
  • allow_methods(GET, HEAD, OPTIONS, POST, PUT, PATCH, DELETE)
  • allow_headers(ACCEPT, AUTHORIZATION, CONTENT_TYPE)
  • allow_credentials(true)
  • Explicit header list (not *) is required since tower-http rejects wildcard headers combined with allow_credentials(true).
• Tests: 5 unit tests in main.rs covering whitelisted/denied origins, preflight allow/reject, and invalid-entry skipping.

Usage

CORS_ALLOWED_ORIGINS=https://dashboard.example.com,https://staging.example.com cargo run
Requests from non-whitelisted origins still reach the backend but get no CORS headers, so browsers refuse to read the response.
Notes
- Fixed a pre-existing compile error in backend/src/api/user.rs (fetch_one(&pool) on an already-referenced pool), which blocked the crate from building and prevented verification.
- Deliberately not wired into k8s/deployment.yaml or the deploy workflows here (out of scope for the issue); a follow-up can add CORS_ALLOWED_ORIGINS to deployment config.
Verification
- cargo check ✅
- cargo fmt --all -- --check ✅
- cargo test --bin zaps-backend cors_tests — 5/5 passing ✅

[drips-wave]

@MerlinTheWhiz Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[MerlinTheWhiz]

@ONEONUORA Hi boss, PR ready for review

[ONEONUORA]

Great job @MerlinTheWhiz