Add environment-driven CORS settings and backend regression tests

backend/app/config.py

@@ -41,6 +41,14 @@ class Settings(BaseSettings):
         default="UTC",
         description="IANA timezone name used when displaying timestamps in the UI.",
     )
+    cors_allowed_origins: list[str] = Field(
+        default_factory=lambda: ["http://localhost:5173"],
+        description=(
+            "Comma-separated list of allowed CORS origins when the frontend is "
+            "served from a different origin than the backend. "
+            "Leave empty to disable cross-origin requests in production."
+        ),
+    )
     log_level: str = Field(
         default="info",
         description="Application log level: debug | info | warning | error | critical.",