server: make CORS configuration configurable

[dubadub]

Summary

cook server applies a hardcoded CORS policy that can't be configured. It should be possible to control the allowed origins (and related CORS settings) from the CLI/config.

Current behaviour

src/server/mod.rs:200:

.layer(
    CorsLayer::new()
        .allow_origin("*".parse::<HeaderValue>().unwrap())
        .allow_methods([Method::GET, Method::POST, Method::PUT, Method::DELETE]),
);

Two problems with this being fixed:

1. Too permissive by default. Any web page in the user's browser can call the API of a running cook server — including the mutating POST/PUT/DELETE routes (shopping list, recipe editing, pantry). That matters more now that --host exposes the server on the LAN. Users who care can't lock it down.
2. Too restrictive in the parts that matter. allow_headers is never set, so tower-http defaults to allowing none. A cross-origin POST with Content-Type: application/json fails preflight, and allow_credentials can't be used at all alongside a wildcard origin. Anyone building a custom frontend against the API has to patch the binary.

Proposal

Add CORS flags to ServerArgs, e.g.:

• --cors-origin <ORIGIN> — repeatable; explicit allowed origins. * for the current wildcard behaviour.
• --cors-allow-credentials — requires explicit origins (error out if combined with *).
• possibly --cors-allow-header <HEADER> / a sensible default of content-type.

Open questions:

• What should the default be? Keeping * preserves backwards compatibility; restricting the default to same-origin (no CORS layer) is safer but could break existing users of the HTTP API. Leaning towards keeping * as default for now and documenting it, but worth deciding.
• Should this also be expressible in a config file rather than flags only?
• Should allow_headers include content-type unconditionally, since the current setup effectively breaks JSON POSTs from browsers anyway?

Notes

• Also update docs/ for the server command and the API docs entry that mentions CORS (src/web/api_docs.rs:56).