Allow CORS origins from CORS_ALLOWED_ORIGINS

Echo compares allowed origins literally, so "https://*" and "http://*" never
matched a real origin and no CORS headers were sent. The allowed origins now
come from CORS_ALLOWED_ORIGINS (comma-separated, checked at startup). When it
is empty, only same-origin requests work, which is enough for the bundled
frontend.

Credentials are no longer allowed since the API uses Bearer tokens. Browsers
may now send Range and X-Queue-Id and read X-Queue-Id and Content-Range.

internal/server/routes.go

@@ -40,14 +40,17 @@ func (s *Server) routes() (*echo.Echo, huma.API) {
 
 	e.Use(logging.RequestLogger())
 	e.Use(echoMiddleware.Recover())
-	e.Use(echoMiddleware.CORSWithConfig(echoMiddleware.CORSConfig{
-		AllowOrigins:     []string{"https://*", "http://*"},
-		AllowMethods:     []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
-		AllowHeaders:     []string{"Accept", "Authorization", "Content-Type", "X-CSRF-Token", middleware.QueueHeader},
-		ExposeHeaders:    []string{middleware.QueueHeader},
-		AllowCredentials: true,
-		MaxAge:           300,
-	}))
+	// Without allowed origins no CORS headers are sent, so only same-origin browser requests work.
+	// The API uses Bearer tokens, not cookies, so credentials are not allowed.
+	if len(s.cfg.CORSAllowedOrigins) > 0 {
+		e.Use(echoMiddleware.CORSWithConfig(echoMiddleware.CORSConfig{
+			AllowOrigins:  s.cfg.CORSAllowedOrigins,
+			AllowMethods:  []string{"GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"},
+			AllowHeaders:  []string{"Accept", "Authorization", "Content-Type", "Range", middleware.QueueHeader},
+			ExposeHeaders: []string{middleware.QueueHeader, "Content-Range", "Accept-Ranges"},
+			MaxAge:        300,
+		}))
+	}
 
 	// The API: /api/v1 is documented at /docs and /openapi.json.
 	a := newAPI(e)