fix(mcp): CORS-aware scaffold, cors.wildcard rule, server-not-appended FP; v1.1.2

internal/index/builtins/README.md

@@ -145,17 +145,21 @@ and then failing at boot because nobody knew which variables to set.
 - **App-owned vars (`APP_*`)** — like `APP_JWT_SECRET` above: the framework can't know these, so
   keeping them in `.env.example` is your discipline, not something it can name-check.
 
-After you compose a component, run **`check_env`** with the modules the app composes: it flags
+After you compose a component, run **`check_env`** with what the app composes: it flags
 `EINHERJAR_*` names that don't exist, required vars you forgot to document, and vars set for a
-module you don't actually compose (dead vars). `get_scaffold` already emits a `.env.example`
-derived from these same tags, so the starting point is correct by construction.
+config you don't actually compose (dead vars). Prefer the **`composes`** input (exact struct
+selectors like `web/server/Config`) over `modules` — it catches struct-level dead vars (e.g.
+`EINHERJAR_SERVER_CORS_ORIGINS` lives on `web.Config`, not `server.Config`). `get_scaffold` already
+emits a `.env.example` derived from these same tags, so the starting point is correct by construction.
 
 ```bash
 # .env.example — copy to .env for local dev. Every var the app reads lives here.
 
 # ── App ───────────────────────────────────────────────────────────────────
 APP_ENV=local
-APP_CORS_ORIGINS=*
+# APP_CORS_ORIGINS — explicit origins for non-local envs (comma-separated).
+# Local uses mw.CORSAllowAll() and ignores this; "*" is rejected by mw.CORS — never use it.
+APP_CORS_ORIGINS=
 APP_JWT_SECRET=change-me
 APP_JWT_ISSUER=myapp
 
@@ -225,11 +229,20 @@ func Run() error {
 	}
 
 	db  := postgres.New(logger, cfg.PG)
+
+	// CORS convention: allow-all in local dev, explicit origins everywhere else.
+	// mw.CORS panics on "*" (it matches no real origin) — allow-all is mw.CORSAllowAll,
+	// never a "*" in APP_CORS_ORIGINS.
+	corsMW := mw.CORSAllowAll()
+	if !strings.EqualFold(cfg.AppEnv, "local") {
+		corsMW = mw.CORS(cfg.CORSOrigins)
+	}
+
 	srv := server.New(logger, cfg.Server,
 		server.WithMiddleware(
 			mw.RequestID(uuid.NewString),
 			mw.Recover(logger),
-			mw.CORS(cfg.CORSOrigins),
+			corsMW,
 			mw.RequestLogger(logger),
 			authjwt.AuthMiddleware(logger, signer, publicPaths),
 			authmw.EnrichmentMiddleware(logger, &claimsEnricher{}),