docs(cors): add CORS configuration planning and tasks

Add comprehensive CORS planning documentation and task breakdown for
Phase 0.5 (8 tasks: T009-T016).

- Create research-cors.md with security analysis and decisions
- Add FR-022a to spec.md for production CORS requirements
- Update tasks.md: 94 → 102 tasks across 9 phases
- Document CORS in README and plan.md

Configuration approach: hybrid (configurable origins/credentials,
hardcoded methods/headers) with restrictive fail-safe defaults.

README.md

@@ -20,6 +20,7 @@ STA will provide a modern web interface for controlling Modbus-compatible relay
 - ✅ Health check and metadata API endpoints
 - ✅ OpenAPI documentation with Swagger UI
 - ✅ Rate limiting middleware
+- ✅ CORS middleware (configurable for production)
 - ✅ SQLite schema and repository for relay labels
 - ✅ Vue 3 + TypeScript frontend scaffolding with Vite
 - ✅ Type-safe API client generation from OpenAPI specs