feat: first-class CORS helper (middleware / preflight) #49

Context

• CORS is only documented as a manual set_middleware use case. Teams expect allow_origins / allow_methods / allow_headers in one place, plus correct preflight for OPTIONS.
• See Feature gaps.

Direction

• Ship a Python helper (e.g. CORSConfig + apply_cors(app, config) or a factory for set_middleware) that returns None to continue, or a short preflight/response for allowed origins.
• Do not break existing single-middleware contract; document interaction if a user also sets set_middleware for other reasons (order / composition).

Acceptance criteria

• Pytest: browser-like preflight and a simple cross-origin GET with Origin header receive expected CORS headers.
• Short section in docs/handlers.md or a dedicated docs/cors.md linked from the index.

Research

• Starlette CORSMiddleware defaults; RSGI scope / headers available on the middleware entry point already.