fix(mcp): CORS-aware scaffold, cors.wildcard rule, server-not-appended FP; v1.1.2

internal/tools/env_tools_test.go

@@ -30,11 +30,14 @@ func TestRenderEnvExample(t *testing.T) {
 	// Required, no default → uncommented with a runnable dev value.
 	mustContain := []string{
 		"APP_ENV=local",
-		"APP_CORS_ORIGINS=*",
+		"APP_CORS_ORIGINS=",
 		"EINHERJAR_PG_HOST=localhost",
 		"EINHERJAR_PG_USER=postgres",
 		"EINHERJAR_PG_PASSWORD=postgres",
 		"EINHERJAR_PG_NAME=myapp",
+		// launcher + health composed → their (defaulted) vars are documented, commented.
+		"# EINHERJAR_COMPONENT_STOP_TIMEOUT=15s",
+		"# EINHERJAR_HEALTH_CHECK_TIMEOUT=5s",
 		// logz is composed → its vars (both defaulted) are documented, commented.
 		"# EINHERJAR_LOG_LEVEL=INFO",
 		"# EINHERJAR_LOG_JSON=false",
@@ -54,6 +57,7 @@ func TestRenderEnvExample(t *testing.T) {
 	mustNotContain := []string{
 		"EINHERJAR_PG_DATABASE",
 		"EINHERJAR_SERVER_ADDR",
+		"APP_CORS_ORIGINS=*", // the wildcard trap must never be emitted
 		// CORS lives on web.Config, which the scaffold does not compose — so it
 		// must not be emitted (it would be a dead var).
 		"EINHERJAR_SERVER_CORS_ORIGINS",