V1 [SEC] Add CORS middleware

[austin-barrington]

Context

The Cargo.toml includes tower-http with the cors feature enabled, but no CorsLayer is applied to the HTTP router (src/adapters/http/router.rs:194-199). This means browser-based applications (Grafana in embedded mode, custom web UIs) making cross-origin requests will be blocked by the same-origin policy.

Deliverables

• Add CorsLayer to the Axum router with sensible defaults.

• Use CorsLayer::permissive() by default (allows any origin, since the API is typically accessed by tools like Telegraf/Grafana, not browsers with credentials).

• Optionally expose a config section to restrict origins in locked-down environments:

  Key	Type	Default	Description
  server.allowed_origins	string	"*"	Comma-separated allowed origins for CORS
  server.allowed_headers	string	"*"	Comma-separated allowed headers

• Add integration test: send OPTIONS preflight request, verify CORS headers in response.

References

• hyperbytedb/Cargo.toml — tower-http with "cors" feature
• src/adapters/http/router.rs:194-199 — no CorsLayer applied
• tower-http CORS docs: https://docs.rs/tower-http/latest/tower_http/cors/

Priority

P1 — Compatibility, security hardening