feat(web): move CORSOrigins to server.Config; web.New warns on empty CORS; align to v1.2.0

doc.go

@@ -12,22 +12,46 @@
 //   - [code.nochebuena.dev/einherjar/web/httputil] — typed handler adapters and HTTP response helpers
 //   - [code.nochebuena.dev/einherjar/web/health]  — concurrent health check handler
 //
-// # Happy path
+// # Choosing web.New vs server.New
+//
+// Two tiers over the same underlying server:
+//
+//   - [New] (web.New) — batteries-included. The recommended middleware stack is wired
+//     for you; CORS uses explicit origins from EINHERJAR_SERVER_CORS_ORIGINS. Use it for
+//     most services. It does NOT support allow-all CORS.
+//   - [code.nochebuena.dev/einherjar/web/server.New] — full control. You compose the
+//     middleware list yourself. Use it when you need a custom middleware order, a custom
+//     request-ID generator, or allow-all CORS in development ([mw.CORSAllowAll], gated by
+//     environment).
+//
+// # web.New — batteries included (explicit CORS origins)
 //
 //	logger := logz.New(logz.Config{JSON: true})
 //	lc := launcher.New(logger)
 //
-//	srv := web.New(logger)
+//	// CORS from EINHERJAR_SERVER_CORS_ORIGINS (explicit origins; empty ⇒ CORS off + log).
+//	srv := web.New(logger, web.Config{Server: cfg.Server})
 //	srv.Get("/health", health.NewHandler(logger, db, cache).ServeHTTP)
 //
 //	lc.Append(srv)
-//	lc.BeforeStart(func() error {
-//	    // register routes
-//	    return nil
-//	})
-//
 //	if err := lc.Run(); err != nil {
 //	    logger.Error("launcher failed", err)
 //	    os.Exit(1)
 //	}
+//
+// # server.New — full control (allow-all CORS in dev)
+//
+// For allow-all CORS in local development, gate it by environment and compose the
+// stack yourself. mw.CORS panics on "*", so allow-all is [mw.CORSAllowAll], never a
+// "*" in the origins list:
+//
+//	var corsMW func(http.Handler) http.Handler
+//	if strings.EqualFold(cfg.AppEnv, "local") {
+//	    corsMW = mw.CORSAllowAll()               // dev: any origin
+//	} else {
+//	    corsMW = mw.CORS(cfg.Server.CORSOrigins)  // prod: explicit origins from env
+//	}
+//	srv := server.New(logger, cfg.Server, server.WithMiddleware(
+//	    mw.Recover(logger), mw.RequestID(uuid.NewString), corsMW, mw.RequestLogger(logger),
+//	))
 package web