feat: add CORS configuration management with environment-based settings

[zeroknowledge0x]

Summary

Implements CORS configuration management with environment-based settings for the Nestera backend.

Fixes #821

Changes

Configuration (backend/src/config/configuration.ts)

• Added cors config block with: enabled, origins, methods, allowedHeaders, credentials, maxAge
• All values are configurable via environment variables with sensible defaults

Environment Validation (backend/src/config/env.validation.ts)

• Added CORS environment variables with Joi validation and defaults

Main Bootstrap (backend/src/main.ts)

• Added app.enableCors() with config-driven origins, methods, headers, credentials, and maxAge
• Logs CORS origins on startup
• Warns when CORS is disabled

Tests (backend/src/config/tests/cors-config.spec.ts)

• Default config when env vars are not set
• Comma-separated origins parsing
• CORS enabled/disabled toggle
• Custom methods and headers parsing
• Whitespace trimming and empty value filtering

Environment Variables

• CORS_ENABLED (default: true) - Enable/disable CORS
• CORS_ORIGINS (default: http://localhost:3000) - Comma-separated allowed origins
• CORS_METHODS (default: GET,HEAD,PUT,PATCH,POST,DELETE,OPTIONS) - Allowed HTTP methods
• CORS_ALLOWED_HEADERS (default: Content-Type,Authorization,Accept) - Allowed request headers
• CORS_CREDENTIALS (default: true) - Allow credentials
• CORS_MAX_AGE (default: 86400) - Preflight cache duration (seconds)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
nestera	Skipped		Jun 1, 2026 3:06pm

[zeroknowledge0x]

Hi! 👋 I noticed the CI checks are showing as unstable. Looking at the workflow history, the Backend CI/CD Pipeline has been failing on the main branch as well (the merge of PR #819 also failed). These appear to be pre-existing CI issues unrelated to this PR's changes.

Would appreciate a review when you get a chance. Thanks! 🙏