Implement CORs

[markmnl]

No description provided.

[Copilot]

Pull request overview

Adds first-party CORS support to the Gin-based API so browser clients can call fmsg-webapi (including successful preflight handling) while keeping existing server-to-server behavior unchanged.

Changes:

• Introduces a configurable CORS middleware (CORSConfig, DefaultCORSConfig, NewCORS) with preflight handling.
• Wires CORS into main.go via FMSG_CORS_ORIGINS, ensuring it runs before JWT auth middleware.
• Adds middleware unit tests and updates README configuration/docs (including TLS/port behavior).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
src/middleware/cors.go	New CORS middleware implementation and configuration defaults
src/middleware/cors_test.go	Test coverage for allowed/disallowed origins, wildcard, and preflight behavior
src/main.go	Enables CORS via env var and ensures middleware ordering; makes TLS port configurable via FMSG_API_PORT
README.md	Documents FMSG_CORS_ORIGINS and clarifies TLS/port guidance

[Copilot]

NewCORS currently short-circuits all OPTIONS requests from an allowed Origin with a 204 response. That treats non-preflight OPTIONS calls (no Access-Control-Request-Method header) as preflight and prevents legitimate OPTIONS handlers from running. Consider only taking the preflight path when Access-Control-Request-Method is present (and otherwise c.Next()).