feat(mcp): scaffold uses real EINHERJAR_SERVER_CORS_ORIGINS; document web.New vs server.New (v1.2.0)

CHANGELOG.md

@@ -6,6 +6,22 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.2.0] — 2026-08-08
+
+Minor. Scaffold and wire docs track the framework’s v1.2.0 CORS change.
+
+### Changed
+
+- Scaffold no longer invents an `APP_CORS_ORIGINS` var — it reads the framework’s real
+  `EINHERJAR_SERVER_CORS_ORIGINS` (now on `server.Config`) via `cfg.Server.CORSOrigins`.
+- `.env.example` documents `EINHERJAR_SERVER_CORS_ORIGINS` in the server section instead of a
+  bespoke app-owned var.
+
+### Added
+
+- Wire builtin docs explain when to use `web.New` (batteries-included) vs `server.New`
+  (full control, env-gated allow-all CORS), so generated services pick the right tier.
+
 ## [1.1.2] — 2026-08-08
 
 Patch. Fixes surfaced by an adversarial review plus the CORS wildcard trap.