feat: Add core application configuration, CORS middleware, and origin restriction with corresponding tests.

[kemalcalak]

Note

Medium Risk
Adds a global HTTP middleware that blocks requests from non-allowlisted Origin headers (returning 404), which can break legitimate clients/proxies if origin/host handling is misconfigured. Behavior changes apply to all endpoints and methods, so regression risk is moderate despite being a contained change.

Overview
Introduces a strict Origin allowlist middleware that returns a generic 404 (RESOURCE_NOT_FOUND) for requests whose Origin is not in settings.all_cors_origins, while explicitly allowing same-origin requests.

Updates Settings.all_cors_origins to only append FRONTEND_HOST when set, and adds async tests covering allowed origins, blocked cross-origin requests, and same-origin POST/PUT behavior.

^{Written by Cursor Bugbot for commit cb3c208. This will update automatically on new commits. Configure here.}

[kemalcalak]

@cursor review

[kemalcalak]

@cursor review

[kemalcalak]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR