security: strict CORS whitelist + reduce JSON body limit to 1mb

Replace permissive CORS with origin whitelist driven by CORS_ORIGIN env
var. Drop body size limit from 10mb to 1mb to reduce DoS surface.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>

backend/src/index.ts

@@ -36,9 +36,28 @@ const discoveryLimiter = rateLimit({
 });
 
 // Middleware
-app.use(cors());
+const allowedOrigins = (process.env.CORS_ORIGIN || '')
-app.use(express.json());
+  .split(',')
-app.use(express.urlencoded({ limit: '10mb', extended: true }));
+  .map((s) => s.trim())
+  .filter(Boolean);
+
+app.use(
+  cors({
+    origin: (origin, callback) => {
+      // Allow same-origin (no Origin header) and whitelisted origins
+      if (!origin) return callback(null, true);
+      if (allowedOrigins.length === 0 || allowedOrigins.includes(origin)) {
+        return callback(null, true);
+      }
+      return callback(new Error('Not allowed by CORS'));
+    },
+    credentials: true,
+    methods: ['GET', 'POST', 'PUT', 'DELETE', 'OPTIONS'],
+    allowedHeaders: ['Content-Type', 'Authorization'],
+  })
+);
+app.use(express.json({ limit: '1mb' }));
+app.use(express.urlencoded({ limit: '1mb', extended: true }));
 
 // Initialize databases on startup
 let isInitialized = false;