feat(middleware): configure CORS from settings in middleware chain

Replace Cors::new() with Cors::from(value.settings.cors.clone()) in the
From<Application> for RunnableApplication implementation to use CORS
settings from configuration instead of hardcoded defaults.

Changes:
- Use From<CorsSettings> for Cors trait to build CORS middleware
- Add unit test verifying CORS middleware uses settings
- Maintain correct middleware order: RateLimit → CORS → Data

Ref: T015

backend/src/settings/cors.rs

@@ -194,7 +194,9 @@ mod tests {
     }
 
     #[test]
-    #[should_panic(expected = "CORS misconfiguration: wildcard origin not allowed with credentials=true")]
+    #[should_panic(
+        expected = "CORS misconfiguration: wildcard origin not allowed with credentials=true"
+    )]
     fn cors_conversion_panics_on_wildcard_with_credentials() {
         let settings = CorsSettings {
             allowed_origins: vec!["*".to_string()],