feat(api): add startup CORS configuration validator and origin policy (#689)

[ravendevhub]

Summary

Resolves #689 by establishing startup CORS origin validation (listener/src/api/cors-validator.ts) that enforces explicit origin declarations via comma-separated strings or JSON lists, validates URL schemas, and strictly prohibits silent fallbacks to permissive wildcards in production environments.

Changes

1. CORS Validation Engine (listener/src/api/cors-validator.ts):
   • Parses and validates origins from CORS_ALLOWED_ORIGINS.
   • Validates URI structure (protocols must be http: or https:, no trailing path segments).
   • Forbids permissive wildcard (*) in production environments unless explicitly opted in.
2. Automated Unit Tests (listener/src/api/cors-validator.test.ts):
   • Tests comma-separated parsing, JSON array format, production wildcard rejection, and malformed URL detection.
3. Documentation (docs/CORS_CONFIGURATION_VALIDATION.md):
   • Outlines CORS policy, configuration formats, and production hardening guidelines.

Acceptance Criteria

• Allowed origins are explicitly configurable.
• Invalid origin configuration is rejected.
• Wildcard configuration is clearly documented.
• Sensitive environments do not silently fall back to permissive settings.