cors.ts allows Access-Control-Allow-Origin: * with credentials – T

[Junman140]

src/middleware/cors.ts: The CORS spec forbids wildcard origin with credentials: true. Browsers will silently reject responses, causing mysterious auth failures for web clients.