docs(cors): add CORS configuration planning and tasks

Add comprehensive CORS planning documentation and task breakdown for
Phase 0.5 (8 tasks: T009-T016).

- Create research-cors.md with security analysis and decisions
- Add FR-022a to spec.md for production CORS requirements
- Update tasks.md: 94 → 102 tasks across 9 phases
- Document CORS in README and plan.md

Configuration approach: hybrid (configurable origins/credentials,
hardcoded methods/headers) with restrictive fail-safe defaults.

specs/001-modbus-relay-control/plan.md

@@ -20,7 +20,7 @@
 **Language/Version**: Rust 1.75+
 **Primary Dependencies**:
 - tokio-modbus 0.17.0 with TCP feature only (Modbus TCP protocol)
-- Poem 3.1 + poem-openapi 5.1 (HTTP API with OpenAPI)
+- Poem 3.1 + poem-openapi 5.1 (HTTP API with OpenAPI + CORS middleware)
 - Tokio 1.48 (async runtime)
 - sqlx 0.8 (SQLite persistence with compile-time verification)
 - mockall + async-trait (testing)
@@ -77,6 +77,7 @@ specs/001-modbus-relay-control/
 ├── spec.md              # Feature specification
 ├── decisions.md         # Architecture and technical decisions
 ├── research.md          # Technical research findings
+├── research-cors.md     # CORS configuration research and decisions
 └── types-design.md      # Type system design (TyDD)
 ```