feat(mcp): add web.allowedorigins-removed rule; document v1.3.0 CORS migration

internal/rules/cors_rules_test.go

@@ -38,6 +38,34 @@ func f() {
 }
 `
 
+const allowedOriginsSelectorSnippet = `package wire
+
+import "code.nochebuena.dev/einherjar/web/mw"
+
+func f(cfg Config) { _ = mw.CORS(cfg.Web.AllowedOrigins) }
+`
+
+const allowedOriginsLiteralSnippet = `package wire
+
+import "code.nochebuena.dev/einherjar/web"
+
+func f() { _ = web.Config{AllowedOrigins: []string{"https://x"}} }
+`
+
+func TestAllowedOriginsSelectorFires(t *testing.T) {
+	got := findingsFor(Run(allowedOriginsSelectorSnippet), "web.allowedorigins-removed")
+	if len(got) == 0 {
+		t.Fatal("web.allowedorigins-removed did not fire on cfg.Web.AllowedOrigins")
+	}
+}
+
+func TestAllowedOriginsLiteralFires(t *testing.T) {
+	got := findingsFor(Run(allowedOriginsLiteralSnippet), "web.allowedorigins-removed")
+	if len(got) == 0 {
+		t.Fatal("web.allowedorigins-removed did not fire on web.Config{AllowedOrigins: ...}")
+	}
+}
+
 func TestCORSWildcardFires(t *testing.T) {
 	got := findingsFor(Run(corsWildcardSnippet), "cors.wildcard-noop")
 	if len(got) == 0 {