Allow CORS origins from CORS_ALLOWED_ORIGINS

Echo compares allowed origins literally, so "https://*" and "http://*" never
matched a real origin and no CORS headers were sent. The allowed origins now
come from CORS_ALLOWED_ORIGINS (comma-separated, checked at startup). When it
is empty, only same-origin requests work, which is enough for the bundled
frontend.

Credentials are no longer allowed since the API uses Bearer tokens. Browsers
may now send Range and X-Queue-Id and read X-Queue-Id and Content-Range.

internal/config/config_test.go

@@ -31,6 +31,7 @@ func TestLoadDefaults(t *testing.T) {
 	assert.Equal(t, "songs", cfg.SoundCheckPath)
 	assert.Equal(t, DefaultReleasesURL, cfg.ReleasesURL)
 	assert.Empty(t, cfg.TrustedProxies)
+	assert.Empty(t, cfg.CORSAllowedOrigins)
 }
 
 func TestLoadMissingRequired(t *testing.T) {
@@ -56,6 +57,21 @@ func TestLoadTrustedProxies(t *testing.T) {
 	assert.ErrorContains(t, err, "TRUSTED_PROXIES")
 }
 
+func TestLoadCORSAllowedOrigins(t *testing.T) {
+	values := validEnv()
+	values["CORS_ALLOWED_ORIGINS"] = "https://music.example.com, http://localhost:5173,"
+	cfg, err := load(env(values))
+	require.NoError(t, err)
+	assert.Equal(t, []string{"https://music.example.com", "http://localhost:5173"}, cfg.CORSAllowedOrigins)
+
+	for _, invalid := range []string{"music.example.com", "ftp://example.com", "https://example.com/app",
+		"https://*.example.com", "https://*", "*", "https://example.com?x=1", "https://user@example.com"} {
+		values["CORS_ALLOWED_ORIGINS"] = invalid
+		_, err = load(env(values))
+		assert.ErrorContains(t, err, "CORS_ALLOWED_ORIGINS", invalid)
+	}
+}
+
 func TestLoadInvalidPort(t *testing.T) {
 	values := validEnv()
 	values["PORT"] = "abc"