docs(web): document CORS wildcard rejection + env-gated convention; align to v1.1.3

CHANGELOG.md

@@ -6,6 +6,20 @@ This module adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html
 
 ---
 
+## [1.1.3] — 2026-08-08
+
+Patch — CORS documentation discoverability.
+
+### Fixed
+
+- `mw.CORS` and `CORSAllowAll` doc comments now document the `"*"` rejection (panic) and the
+  env-gated CORS convention (`local -> CORSAllowAll`, else `mw.CORS(origins)`), so `search_symbols`
+  surfaces it — previously the convention lived only in code comments and the wire example.
+
+### Changed
+
+- Bumped `contracts`, `core` to v1.1.3.
+
 ## [1.1.2] — 2026-08-08
 
 Patch — CORS wildcard hardening plus documentation fixes.