Massive update

drb-c2-core/app/config.py

@@ -20,6 +20,9 @@ class Settings(BaseSettings):
     # Internal service key — allows server-side services (discord bot) to call C2 without Firebase
     service_key: Optional[str] = None
 
+    # CORS — comma-separated list of allowed origins, or "*" for all
+    cors_origins: list[str] = ["*"]
+
     class Config:
         env_file = ".env"