c2-core: add CORS middleware so the browser can call the REST API (#110)

The Archive page's GET /calls/search failed its CORS preflight (OPTIONS -> 405, no Access-Control-* headers). Allow the app origin(s) explicitly for the standard methods and the authorization/content-type headers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01Tbknwttzou4s46PAykmtix

drb-c2-core/app/config.py

@@ -180,16 +180,18 @@ class Settings(BaseSettings):
     # between genuinely separate transmissions on a busy dispatch channel.
     duplicate_window_seconds: int = 10
 
-    # CORS — set to your frontend origin(s) in production, e.g. ["https://app.example.com"]
-    # Defaults to "*" for local development only.
+    # Browser origins allowed to call this API cross-origin. The only browser
+    # caller is the frontend's Archive page (GET /calls/search) — every other
+    # page reads Firestore directly. The frontend is served on the BARE domain
+    # (see infra Caddyfile.j2 — only drb. and api. have DNS records), so the
+    # default is that origin, not app.<domain>. Override via CORS_ORIGINS (JSON
+    # list) if the frontend ever moves; keep infra/.../c2-core.env.j2 in sync.
     #
-    # Leaving this as "*" is not merely permissive: main.py turns OFF
-    # allow_credentials when it sees a wildcard, because Starlette would
-    # otherwise reflect each caller's origin back WITH
-    # Access-Control-Allow-Credentials. So a production deployment that
-    # forgets to set this gets a loud ERROR at startup and loses credentialed
-    # cross-origin requests, rather than silently accepting every origin.
-    cors_origins: list[str] = ["*"]
+    # A "*" entry here still works for local dev but is refused a credentialed
+    # response: main.py never enables allow_credentials (auth is a Bearer
+    # header, not a cookie), and it logs a loud ERROR when it sees a wildcard
+    # in a deployment so a forgotten override is visible.
+    cors_origins: list[str] = ["https://drb.cusano.net"]
 
     # Discord webhook URL that app/internal/ai_health.py posts to when an AI
     # tier (transcription/correlation) transitions into or out of degraded