[guptakumarranjeet150]

Summary

Implements hardened CORS configuration locked down per environment, preventing unauthorized external websites from making credentialed requests in production while maintaining smooth development and staging workflows.

Closes #1384

Acceptance Criteria Verified

• Production Lockdown: Only origins specified in CORS_ALLOWED_ORIGINS (or sanitized fallback) are permitted. Wildcards in production are strictly rejected to eliminate credential leakage.
• Staging & Development Flexibility: Permits configured origins, staging domains, and local development ports (localhost:3000, localhost:5173, localhost:3001).
• Preflight OPTIONS Handling: Explicitly specifies Access-Control-Allow-Methods (GET, HEAD, PUT, PATCH, POST, DELETE, OPTIONS), Access-Control-Allow-Headers, exposed headers, and 204 status code.
• Credentialed Protection: Explicitly configures credentials: true only for whitelisted origins.
• Disallowed Origin Rejection: Requests from disallowed origins in production return 403 Forbidden with CORS policy: origin not allowed error and no CORS headers.
• Comprehensive Unit Tests: 6/6 tests passing in server/test/cors.middleware.test.js.

[vercel]

@guptakumarranjeet150 is attempting to deploy a commit to the paul joseph's projects Team on Vercel.

A member of the Team first needs to authorize it.