fix: tighten CORS defaults

[zpf2234]

Summary

Fixes #90.

This PR tightens the backend CORS defaults and makes the FastAPI middleware use the existing CORS_ALLOW_ORIGINS setting instead of a hard-coded wildcard origin.

Changes:

• use settings.CORS_ALLOW_ORIGINS in backend/app/main.py
• default CORS origins to the local frontend dev origins
• parse comma-separated CORS origins more defensively
• disable allow_credentials automatically when CORS_ALLOW_ORIGINS=* is explicitly configured
• document the CORS setting in the Chinese and English READMEs

Verification

• python -m py_compile backend/app/config/setting.py backend/app/main.py
• uv run ruff check app/config/setting.py app/main.py
• verified default CORS parsing and wildcard behavior with a small uv run python check

[zpf2234]

整体方向对，CORS 默认值和 credentials 逻辑修得比较稳，README 也补到了。\n\n我这边看下来建议再补一个最小单测，覆盖三种情况：\n1. 默认值解析为 localhost origins\n2. 显式 时 \n3. 逗号分隔字符串和 list 输入都能正常解析\n\n除此之外这版可读性和回退策略都不错。