Fix CORS Errors on Flask

Flask-Cors decorates apps or blueprints with per-resource rules. Prefer resources={r"/api/*": {"origins": [...]}} over blanket open CORS so admin namespaces stay locked down.

When supports_credentials is true, never use * for origins. Flask sessions and JWT in cookies require exact origin reflection you control.

CORSFixer validates preflight against your live endpoint.