Go migration. Test execution 0209 snapshot

[Ginxo]

📝 Summary

due to stolostron#6779 (comment)

Overview

Resolves preflight OPTIONS failures in development (cors-options-dev and cors-options-dev/multicloud contract tests) by porting the Node backend's dev CORS middleware directly into the Go server.

Problem & Fix

• Problem: Unauthenticated OPTIONS requests to /api and /multicloud/api were routed straight to k8sproxy, returning 401 Unauthorized instead of proper CORS preflight headers.
• Fix: Introduced a top-level backend/internal/cors middleware. In development (NODE_ENV != production), it short-circuits OPTIONS requests with a 200 OK, reflects the request Origin, and sets Access-Control-Allow-Credentials: true.
• Sidecar Impact: Node's backend-node/src/lib/cors.ts is now redundant for standard dev flows (as browser traffic routes through Go on :4000), but remains harmless until cleanup.

Verification
Contract test suite execution against https://localhost:4000:

• Executed: 107
• Passed: 84 OK / 23 SOFT (expected skipped cases)
• Failed: 0

Key Changes

• backend/internal/cors/cors.go Implemented dev CORS middleware short-circuiting
• backend/internal/server/server.go Wired CORS middleware as top-level handler in Chi router

After this PR

Backend: https://localhost:4000
Building test binary...
Running full catalog (TestCatalogAgainstBackend)...
PASS

════════════════════════════════════════════════════
 Contract test summary
════════════════════════════════════════════════════
 Executed: 107
 OK: 84
 SOFT (skipped): 23
 FAIL: 0
════════════════════════════════════════════════════
 Soft skips (optional upstream missing):
   metrics-observability-query — status 502 is in softStatuses
   metrics-observability-query/multicloud — status 502 is in softStatuses
   mcp-hub-namespaces — status 502 is in softStatuses
   mcp-hub-namespaces/multicloud — status 502 is in softStatuses
   vm-resource-usage — status 500 is in softStatuses
   vm-resource-usage/multicloud — status 500 is in softStatuses
   serve-plugin-manifest — status 404 is in softStatuses
   serve-plugin-manifest/multicloud — status 404 is in softStatuses
   mcp-websocket-watch — websocket dial: websocket: bad handshake (status 502)
   placement-debug — status 500 is in softStatuses
   placement-debug/multicloud — status 500 is in softStatuses
   rosa-aws-account-ids — status 500 is in softStatuses
   rosa-aws-account-ids/multicloud — status 500 is in softStatuses
   rosa-billing-accounts — status 500 is in softStatuses
   rosa-oidc-configs — status 500 is in softStatuses
   rosa-regions — status 500 is in softStatuses
   rosa-cluster-name-check — status 500 is in softStatuses
   rosa-sts-role-arns — status 500 is in softStatuses
   rosa-vpcs — status 500 is in softStatuses
   rosa-sts-ocm-role — status 500 is in softStatuses
   rosa-sts-user-role — status 500 is in softStatuses
   rosa-openshift-versions — status 500 is in softStatuses
   rosa-machine-types — status 500 is in softStatuses
 Mandatory cases passed. 23 optional case(s) skipped.
════════════════════════════════════════════════════