fix(web): mw.CORS rejects wildcard; fix README fences; align to v1.1.2

README.md

@@ -1,6 +1,6 @@
 # einherjar/web
 
-[![version](https://img.shields.io/badge/version-v1.1.1-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
+[![version](https://img.shields.io/badge/version-v1.1.2-5C4EE5?style=flat-square)](https://code.nochebuena.dev/einherjar/web)
 [![license](https://img.shields.io/badge/license-AGPL--3.0-22863A?style=flat-square)](LICENSE)
 [![go](https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white)](https://go.dev)
 
@@ -46,7 +46,7 @@ logger := logz.New(logz.Config{JSON: true, StaticArgs: []any{"service", "api"}})
 srv := web.New(logger)
 // Pre-wired stack: Recover → RequestID (UUID v7/v4) → RequestLogger → [CORS]
 
-srv.Get("/health", health.NewHandler(logger, db, cache))
+srv.Get("/health", health.NewHandler(logger, db, cache).ServeHTTP)
 
 lc := launcher.New(logger)
 lc.Append(srv)
@@ -76,7 +76,7 @@ Environment variables for `web.New`:
 | `EINHERJAR_SERVER_WRITE_TIMEOUT` | `10s` | HTTP write timeout |
 | `EINHERJAR_SERVER_IDLE_TIMEOUT` | `120s` | Keep-alive idle timeout |
 | `EINHERJAR_SERVER_SHUTDOWN_TIMEOUT` | `10s` | Graceful shutdown budget |
-| `EINHERJAR_SERVER_CORS_ORIGINS` | _(empty — CORS off)_ | Comma-separated allowed origins |
+| `EINHERJAR_SERVER_CORS_ORIGINS` | _(empty — CORS off)_ | Comma-separated allowed origins (`*` is rejected — use `mw.CORSAllowAll()` in code for allow-all) |
 
 ### Tier 2 — Full control (`server.New`)
 
@@ -90,9 +90,9 @@ import (
 
 srv := server.New(logger, server.Config{Port: 9090},
     server.WithMiddleware(
-        mw.Recover(),
+        mw.Recover(logger),
         mw.RequestID(myIDGenerator),
-        mw.CORS([]string{"*"}),
+        mw.CORS([]string{"https://example.com"}),
         mw.RequestLogger(logger),
         myOwnMiddleware,
     ),
@@ -177,7 +177,7 @@ values are mapped to their canonical HTTP status codes (full 16-code table below
 import "code.nochebuena.dev/einherjar/web/health"
 
 // db and cache implement observability.Checkable
-srv.Get("/health", health.NewHandler(logger, db, cache))
+srv.Get("/health", health.NewHandler(logger, db, cache).ServeHTTP)
 
 // Response shape:
 // {"status":"UP","components":{"db":{"status":"UP","latency":"1.2ms"}}}