Replace Cors::new() with Cors::from(value.settings.cors.clone()) in the
From<Application> for RunnableApplication implementation to use CORS
settings from configuration instead of hardcoded defaults.
Changes:
- Use From<CorsSettings> for Cors trait to build CORS middleware
- Add unit test verifying CORS middleware uses settings
- Maintain correct middleware order: RateLimit → CORS → Data
Ref: T015
Implement From<CorsSettings> for Cors trait to configure CORS middleware
with production-ready security validation.
- Move CorsSettings to backend/src/settings/cors.rs module
- Validate wildcard + credentials constraint (browser security policy)
- Configure allowed methods, headers, credentials, and max_age
- Add structured logging for CORS configuration
- Move tests from settings/mod.rs and startup.rs to cors module
Ref: T014
phundrak
