FastAPI Security Fixes

FastAPI’s async stack uses CORSMiddleware for browser clients; LLM gateways often need the same for admin UIs calling vLLM. Headers may be terminated at Nginx—see Nginx hub.

OAuth resource servers should validate issuer and audience aggressively.