feat(web)!: remove web.Config.AllowedOrigins; CORS lives only on server.Config.CORSOrigins (v1.3.0)

CHANGELOG.md

@@ -6,6 +6,29 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.3.0] — 2026-08-08
+
+Minor release carrying a **breaking API change** to CORS configuration. The framework is
+private with controlled consumers, so this ships in the 1.x line with a loud compile break
+instead of a v2 module-path (`/v2`) migration.
+
+### Removed
+
+- **⚠️ BREAKING: `web.Config.AllowedOrigins` removed.** CORS origins now have a single
+  home: `server.Config.CORSOrigins` (env `EINHERJAR_SERVER_CORS_ORIGINS`). The field was
+  env-backed through v1.1.x and a code-only override in v1.2.0 — reading it after the env
+  tag moved silently served *no* CORS. Removing it turns that runtime trap into a compile
+  error.
+
+  **Migration:** replace `cfg.Web.AllowedOrigins` with `cfg.Server.CORSOrigins`, and
+  `web.Config{AllowedOrigins: o}` with `web.Config{Server: server.Config{CORSOrigins: o}}`
+  — or just let `web.New` read `EINHERJAR_SERVER_CORS_ORIGINS`. The MCP flags any leftover
+  reference (`validate_snippet` rule `web.allowedorigins-removed`).
+
+### Changed
+
+- Bumped `contracts`, `core` to v1.3.0.
+
 ## [1.2.0] — 2026-08-08
 
 Minor — CORS configuration moved to its rightful struct; `web.New` made safe-by-default.