fix(web): mw.CORS rejects wildcard; fix README fences; align to v1.1.2

mw/cors.go

@@ -11,6 +11,15 @@ const (
 // Returns 204 No Content for OPTIONS preflight requests.
 // Pass the outermost origins first; an empty slice is a no-op.
 func CORS(origins []string) func(http.Handler) http.Handler {
+	// "*" is a silent no-op here (exact-match only) — reject it loudly at
+	// construction so a misconfigured service fails to boot instead of quietly
+	// blocking every browser. For allow-all, call CORSAllowAll (development only).
+	for _, o := range origins {
+		if o == "*" {
+			panic(`mw.CORS: "*" is not a valid origin — list explicit origins, or use CORSAllowAll() for allow-all`)
+		}
+	}
+
 	originSet := make(map[string]struct{}, len(origins))
 	for _, o := range origins {
 		originSet[o] = struct{}{}