[Backend] Add configurable CORS middleware for custom allowed origins

[blessedDev-xyz]

Summary

Replace the hardcoded allow_origin(Any) CORS policy with a configurable tower-http middleware that reads allowed origins from the ALLOWED_ORIGINS environment variable.

Changes

• Added allowed_origins: String field to AppConfig with a default of "" (allow all)
• Added default_allowed_origins() helper and config default in load_config()
• Replaced static CorsLayer::new().allow_origin(Any) with dynamic origin parsing: comma-separated ALLOWED_ORIGINS values are parsed into HeaderValue list; empty/unset falls back to Any

Usage

# Restrict to specific origins
ALLOWED_ORIGINS=http://localhost:3000,https://app.example.com cargo run -p soroscope-core

# Allow all (default, backward-compatible)
cargo run -p soroscope-core

Validation

• cargo check passes with no errors

Closes #588

[drips-wave]

@blessedDev-xyz Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[EDOHWARES]

Nice implementation, LGTM!