feat: tighten CORS policy and improve payroll history empty states

[charlesbarleyman]

Summary

• tighten backend CORS behavior so requests are rejected when no trusted origins are configured, and document comma-separated allowlist usage for staging/production domains.
• improve payroll history empty state copy to show a friendlier "No transactions yet" message when no data exists while keeping filter-empty behavior explicit.
• improve dashboard text contrast in revenue split views by raising muted zinc text tones for better readability.

Validation

• frontend: npm run test -- TransactionHistory.integration.test.tsx (passes)
• backend: build currently has pre-existing TypeScript errors unrelated to this change, so full backend build is not green in this workspace.

Closes #359
Closes #362
Closes #363
Closes #364

[drips-wave]

@charlesbarleyman Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits