c2-core: add CORS middleware so the browser can call the REST API (#110)

The Archive page's GET /calls/search failed its CORS preflight (OPTIONS -> 405, no Access-Control-* headers). Allow the app origin(s) explicitly for the standard methods and the authorization/content-type headers.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Claude-Session: https://claude.ai/code/session_01Tbknwttzou4s46PAykmtix

drb-c2-core/tests/test_cors_policy.py

@@ -5,8 +5,9 @@ Starlette does not reject `allow_origins=["*"]` combined with
 `allow_credentials=True`. It reflects the caller's Origin back in
 Access-Control-Allow-Origin and still sends
 Access-Control-Allow-Credentials: true, so the effective policy is the
-opposite of what a wildcard usually means. main.py defuses that by turning
-credentials off whenever it sees a wildcard; these tests hold it to that.
+opposite of what a wildcard usually means. main.py never enables
+credentials at all (auth is a Bearer header, not a cookie), which makes
+that pair unrepresentable; these tests hold it to that.
 
 The policy lives in a pure function so it can be exercised directly --
 reloading app.main to vary settings drags every router back through import
@@ -28,11 +29,11 @@ def test_wildcard_among_real_origins_still_disables_credentials():
     assert cors_allows_credentials(["https://app.example.com", "*"]) is False
 
 
-def test_named_origins_keep_credentials():
-    # Naming your origins is how you ask for credentialed requests, so a
-    # correctly configured deployment must not be penalised.
-    assert cors_allows_credentials(["https://app.example.com"]) is True
-    assert cors_allows_credentials([]) is True
+def test_credentials_never_enabled_even_for_named_origins():
+    # Auth here is a Bearer header, not a cookie, so credentialed CORS is
+    # never needed. The predicate is hard-off regardless of the origin list.
+    assert cors_allows_credentials(["https://app.example.com"]) is False
+    assert cors_allows_credentials([]) is False
 
 
 def test_the_app_actually_mounted_that_policy():
@@ -42,6 +43,7 @@ def test_the_app_actually_mounted_that_policy():
         (mw.kwargs for mw in app.user_middleware if mw.cls is CORSMiddleware), None
     )
     assert opts is not None, "CORSMiddleware is not mounted at all"
+    assert opts["allow_credentials"] is False
     assert opts["allow_credentials"] is cors_allows_credentials(settings.cors_origins)