test: cover CORS preflight and security headers

[felixvippp-ai]

Summary

• add src/cors-headers.test.ts with focused Supertest coverage for the CORS middleware and security-header middleware
• cover allowlisted origin reflection, Vary: Origin, Access-Control headers, disallowed/missing origins, and the 204 OPTIONS short-circuit
• assert the exact current security headers on JSON, CSV, and text/plain responses

Closes #100.

Tests

• npm.cmd run build passed
• npm.cmd run lint passed
• $env:NODE_ENV='test'; node --test dist/cors-headers.test.js passed: 4 tests, 1 suite
• $env:NODE_ENV='test'; node --test dist/*.test.js dist/**/*.test.js passed: 73 tests, 6 suites

Note: on this Windows shell, the package's raw npm test script exits before running tests because it uses POSIX NODE_ENV=test assignment. I ran the equivalent post-build Node test command above after npm.cmd run build.

[mikewheeleer]

thanks for the effort here @felixvippp-ai! 🙏 issue #100 isn't assigned to you, and we merge from the assigned contributor to keep the campaign fair and avoid duplicate work. please claim an open unassigned issue first, then open your PR. closing this one for now — hope to see it back 🙌