Allow CORS origins from CORS_ALLOWED_ORIGINS

Echo compares allowed origins literally, so "https://*" and "http://*" never
matched a real origin and no CORS headers were sent. The allowed origins now
come from CORS_ALLOWED_ORIGINS (comma-separated, checked at startup). When it
is empty, only same-origin requests work, which is enough for the bundled
frontend.

Credentials are no longer allowed since the API uses Bearer tokens. Browsers
may now send Range and X-Queue-Id and read X-Queue-Id and Content-Range.

internal/server/routes_test.go

@@ -196,3 +196,30 @@ func TestTrustedProxies(t *testing.T) {
 	assert.Equal(t, http.StatusTooManyRequests, e.doBody(http.MethodPost, "/api/v1/token", `{}`, "X-Forwarded-For", "10.0.0.1").Code)
 	assert.Equal(t, http.StatusOK, e.doBody(http.MethodPost, "/api/v1/token", `{}`, "X-Forwarded-For", "10.0.0.2").Code)
 }
+
+func TestCORSAllowedOrigins(t *testing.T) {
+	e := newTestEnv(t, func(c *config.Config) { c.CORSAllowedOrigins = []string{"https://music.example.com"} })
+
+	rec := e.do(http.MethodGet, "/api/v1/music/list", "Origin", "https://music.example.com")
+	assert.Equal(t, http.StatusOK, rec.Code)
+	assert.Equal(t, "https://music.example.com", rec.Header().Get("Access-Control-Allow-Origin"))
+	assert.Contains(t, rec.Header().Get("Access-Control-Expose-Headers"), "X-Queue-Id")
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Credentials"))
+
+	preflight := e.do(http.MethodOptions, "/api/v1/music/list", "Origin", "https://music.example.com",
+		"Access-Control-Request-Method", "GET", "Access-Control-Request-Headers", "authorization,x-queue-id")
+	assert.Equal(t, http.StatusNoContent, preflight.Code)
+	assert.Equal(t, "https://music.example.com", preflight.Header().Get("Access-Control-Allow-Origin"))
+	assert.Contains(t, preflight.Header().Get("Access-Control-Allow-Headers"), "X-Queue-Id")
+	assert.Contains(t, preflight.Header().Get("Access-Control-Allow-Headers"), "Authorization")
+
+	other := e.do(http.MethodGet, "/api/v1/music/list", "Origin", "https://evil.example.com")
+	assert.Empty(t, other.Header().Get("Access-Control-Allow-Origin"), "other origins get no CORS headers")
+}
+
+func TestCORSWithoutAllowedOrigins(t *testing.T) {
+	e := newTestEnv(t)
+	rec := e.do(http.MethodGet, "/api/v1/version", "Origin", "https://music.example.com")
+	assert.Equal(t, http.StatusOK, rec.Code, "the request itself works; the browser blocks reading it")
+	assert.Empty(t, rec.Header().Get("Access-Control-Allow-Origin"))
+}