feat(web): move CORSOrigins to server.Config; web.New warns on empty CORS; align to v1.2.0

server/config.go

@@ -11,6 +11,12 @@ type Config struct {
 	WriteTimeout    time.Duration `env:"EINHERJAR_SERVER_WRITE_TIMEOUT"    envDefault:"10s"`
 	IdleTimeout     time.Duration `env:"EINHERJAR_SERVER_IDLE_TIMEOUT"     envDefault:"120s"`
 	ShutdownTimeout time.Duration `env:"EINHERJAR_SERVER_SHUTDOWN_TIMEOUT" envDefault:"10s"`
+
+	// CORSOrigins is the allowed cross-origin list (comma-separated in the env var).
+	// web.New applies mw.CORS with it automatically; callers of server.New pass it to
+	// mw.CORS themselves. "*" is rejected by mw.CORS — use mw.CORSAllowAll for allow-all
+	// (development only).
+	CORSOrigins []string `env:"EINHERJAR_SERVER_CORS_ORIGINS" envSeparator:","`
 }
 
 const defaultShutdownTimeout = 10 * time.Second

server/doc.go

@@ -4,9 +4,22 @@
 // directly into [launcher.New] and exposes the full chi routing API.
 //
 // For the happy path use [web.New], which pre-wires the recommended middleware
-// stack. Use this package directly when you need explicit control over
-// middleware order, a custom request-ID generator, or any other deviation from
-// the defaults.
+// stack (explicit-origin CORS included). Use this package directly when you need
+// explicit control over middleware order, a custom request-ID generator, or
+// allow-all CORS in development.
+//
+// # CORS
+//
+// [Config.CORSOrigins] loads EINHERJAR_SERVER_CORS_ORIGINS. Gate allow-all by
+// environment — mw.CORS panics on "*", so allow-all is [mw.CORSAllowAll], never a
+// wildcard origin:
+//
+//	var corsMW func(http.Handler) http.Handler
+//	if strings.EqualFold(cfg.AppEnv, "local") {
+//	    corsMW = mw.CORSAllowAll()          // dev: any origin
+//	} else {
+//	    corsMW = mw.CORS(cfg.Server.CORSOrigins) // prod: explicit origins
+//	}
 //
 // # Basic usage
 //