Enforce configured CORS origin allowlist

[coder13]

Follow-up slice of #227.

Replace the permissive credentialed CORS configuration with the existing configured CORS origin allowlist.

Scope:

• use the runtime CORS_ORIGINS configuration for credentialed browser requests;
• add focused tests for an allowed origin, a rejected origin, and same-origin/no-Origin behavior;
• keep local Compose defaults and production environment examples aligned.

Acceptance criteria:

• unknown cross-origin requests do not receive credentialed CORS permission;
• known development and production origins continue to work;
• no email-related behavior is added or changed.

Production configuration validation remains part of #176.