fix(backend): parse BACKEND_CORS_ORIGINS correctly instead of bracket-string literal

[vladmesh]

Summary

• BACKEND_CORS_ORIGINS was split on commas even when compose supplied a JSON array default (["http://localhost"]), so the real origin became the literal bracketed/quoted string and never matched a browser's Origin header — CORS was effectively broken in every environment.
• pydantic-settings also pre-decodes list-typed env values as JSON before any field validator runs, so a plain comma-separated value (the format documented in .env.example/README) would have crashed startup outright once it reached that code path.
• Fixed the validator to accept both a JSON array string and a comma-separated string, opted the field out of pydantic-settings' automatic JSON pre-decode (NoDecode), and raises a clear error for anything else (malformed JSON, non-string array items, empty value).
• Aligned docker-compose.yml and docker-compose.stand.yml defaults plus .env.stand on the comma-separated format already used in .env.example/README, so there's one format across dev/stand instead of a silent split.
• docker-compose.prod.yml never set BACKEND_CORS_ORIGINS and is left untouched — adding it would be expanding CORS config, which is out of scope.

Acceptance criteria

• Parser accepts JSON array and comma-separated string, output is always clean URLs: done, see services/backend/tests/api/test_config.py::TestParseCorsOrigins and TestSettingsFromEnv (the latter exercises the real pydantic-settings env pipeline, not just the validator function).
• dev/stand compose values consistent with the parser, one format, no silent divergence: done — docker-compose.yml, docker-compose.stand.yml, .env.stand now all use the comma-separated format.
• Unit test for both formats + garbage value with a clear error: done, same test file (13 tests, includes malformed JSON, non-string JSON array, and empty-string cases).
• Live check on stand: built and ran the isolated personal_site_stand compose stack with BACKEND_CORS_ORIGINS=http://localhost:4331 from .env.stand. curl -H "Origin: http://localhost:4331" against /api/health and an OPTIONS preflight against /api/v1/profile both returned access-control-allow-origin: http://localhost:4331 (clean, no brackets/quotes); a mismatched Origin: http://evil.example got no CORS header. Confirmed in-container that Settings().BACKEND_CORS_ORIGINS == ['http://localhost:4331'].

Full backend suite (pytest --cov=app, ruff check, ruff format --check, mypy) passes; pre-existing ruff-format findings in 3 unrelated alembic files and profile.py are untouched by this change (verified against the pre-change tree).