feat(server): configure CORS with explicit security settings

Replace default CORS middleware with explicit configuration to properly
control cross-origin access. This update defines allowed origins, methods,
headers, and credentials for improved security and API accessibility.

Configuration changes:
- Allow all origins (*) for development flexibility
- Support standard HTTP methods (GET, POST, PUT, DELETE, OPTIONS)
- Expose Content-Length header for response inspection
- Disable credentials to simplify authentication flow

cmd/server/main.go

@@ -140,7 +140,13 @@ func main() {
 	// Middleware
 	e.Use(echomiddleware.RequestLogger())
 	e.Use(echomiddleware.Recover())
-	e.Use(echomiddleware.CORS())
+	e.Use(echomiddleware.CORSWithConfig(echomiddleware.CORSConfig{
+		AllowOrigins:     []string{"*"},
+		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "OPTIONS"},
+		AllowHeaders:     []string{"Origin", "Content-Type", "Authorization"},
+		ExposeHeaders:    []string{"Content-Length"},
+		AllowCredentials: false,
+	}))
 	e.Use(ratelimit.RequestTracingMiddleware(cfg))
 
 	// Rate limiter for auth endpoints