Fix CORS Errors on Express

The cors package wraps preflight and response headers for Express. Pass an origin function that whitelists dev and prod frontends instead of * when cookies or Authorization headers are involved.

Order middleware so cors runs before routes; log rejected origins during integration tests. Combine with Helmet for a full browser-facing hardening stack.

Instrument with CORSFixer to confirm OPTIONS returns the status and headers your SPA expects.