fix: CORS hardening and production URL config (#63-#66)

[Dev-makeem]

Closes #63
Closes #64
Closes #65
Closes #66

Summary

64f4ff8: fix(config): require BASE_URL and WEB_APP_URL in production (#63)

Added a pre-validation check in src/config.ts that exits at boot with a clear [config] message when NODE_ENV=production and either BASE_URL or WEB_APP_URL is unset or blank. Development and test behavior, including the localhost defaults, is unchanged.

5b1c738: fix(cors): allow PATCH in preflight (#64)

Added PATCH to the allowed methods in createCorsOptions (src/cors.ts) so browser preflights for the PATCH publisher routes succeed. A test in src/cors.test.ts asserts the method is present.

b44702e: fix(cors): bound rejected-origin tracking (#65)

Replaced the unbounded warnedOrigins bookkeeping with a markOriginWarned helper capped at MAX_WARNED_ORIGINS (500) that evicts the oldest entry at the limit. A test in src/cors.test.ts covers the cap.

585f677: fix(ci): replace wildcard ALLOWED_ORIGINS in catalog seed workflow (#66)

Replaced ALLOWED_ORIGINS: "*" in .github/workflows/catalog-seed.yml with an explicit local origin. Also set BASE_URL and WEB_APP_URL there so the production-mode seed run still boots under the new requirement from #63.

[vercel]

@Dev-makeem is attempting to deploy a commit to the work Team on Vercel.

A member of the Team first needs to authorize it.

[drips-wave]

@Dev-makeem Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits