feat(web): add simple auth UI + enable CORS for testing

backend/src/main.cc

@@ -11,6 +11,28 @@ int main(int argc, char** argv) {
 
   csp::AppState::Instance().Init(db_path);
 
+  // CORS (dev-friendly). In production, prefer reverse proxy same-origin.
+  drogon::app().registerPreRoutingAdvice([](const drogon::HttpRequestPtr& req,
+                                           drogon::AdviceCallback&& cb,
+                                           drogon::AdviceChainCallback&& chainCb) {
+    if (req->method() == drogon::Options) {
+      auto resp = drogon::HttpResponse::newHttpResponse();
+      resp->setStatusCode(drogon::k200OK);
+      resp->addHeader("Access-Control-Allow-Origin", "*");
+      resp->addHeader("Access-Control-Allow-Methods", "GET,POST,PUT,PATCH,DELETE,OPTIONS");
+      resp->addHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+      cb(resp);
+      return;
+    }
+    chainCb();
+  });
+
+  drogon::app().registerPostHandlingAdvice([](const drogon::HttpRequestPtr&,
+                                             const drogon::HttpResponsePtr& resp) {
+    resp->addHeader("Access-Control-Allow-Origin", "*");
+    resp->addHeader("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  });
+
   drogon::app()
       .addListener("0.0.0.0", 8080)
       .setThreadNum(4);