feat(web): move CORSOrigins to server.Config; web.New warns on empty CORS; align to v1.2.0

server/doc.go

@@ -4,9 +4,22 @@
 // directly into [launcher.New] and exposes the full chi routing API.
 //
 // For the happy path use [web.New], which pre-wires the recommended middleware
-// stack. Use this package directly when you need explicit control over
-// middleware order, a custom request-ID generator, or any other deviation from
-// the defaults.
+// stack (explicit-origin CORS included). Use this package directly when you need
+// explicit control over middleware order, a custom request-ID generator, or
+// allow-all CORS in development.
+//
+// # CORS
+//
+// [Config.CORSOrigins] loads EINHERJAR_SERVER_CORS_ORIGINS. Gate allow-all by
+// environment — mw.CORS panics on "*", so allow-all is [mw.CORSAllowAll], never a
+// wildcard origin:
+//
+//	var corsMW func(http.Handler) http.Handler
+//	if strings.EqualFold(cfg.AppEnv, "local") {
+//	    corsMW = mw.CORSAllowAll()          // dev: any origin
+//	} else {
+//	    corsMW = mw.CORS(cfg.Server.CORSOrigins) // prod: explicit origins
+//	}
 //
 // # Basic usage
 //