feat(mcp): add web.allowedorigins-removed rule; document v1.3.0 CORS migration

internal/index/builtins/README.md

@@ -206,6 +206,25 @@ appended, then feature hooks, then `lc.Run()`.
 Whichever tier you pick, CORS origins always come from the framework var
 `EINHERJAR_SERVER_CORS_ORIGINS` (`cfg.Server.CORSOrigins`) — never invent an app-owned CORS var.
 
+> **CORS has one home: `server.Config.CORSOrigins`.** In framework `v1.x`, `web.Config`
+> carried an `AllowedOrigins` field. It was env-backed through `v1.1.x` and a code-only override
+> in `v1.2.0` — reading it after the env tag moved silently served *no* CORS. **`v2.0.0` removed the
+> field entirely** so the mistake fails at compile time instead of at runtime. If you are migrating
+> code that read `web.Config.AllowedOrigins` or set it in a struct literal, switch to
+> `cfg.Server.CORSOrigins`:
+>
+> ```go
+> // v1.x (removed) — compiled but could serve no CORS after v1.2.0:
+> //   mw.CORS(cfg.Web.AllowedOrigins)
+> //   web.New(logger, web.Config{AllowedOrigins: origins})
+>
+> // v2.0.0 — the single source of truth:
+> mw.CORS(cfg.Server.CORSOrigins)                               // server.New tier
+> web.New(logger, web.Config{Server: cfg.Server})              // web.New reads it automatically
+> ```
+>
+> `validate_snippet` flags any lingering `AllowedOrigins` reference (`web.allowedorigins-removed`).
+
 ```go
 package wire