Fix CORS config: remove duplicate, move localhost to dev only

[mbryzek]

Summary

• Remove duplicate play.filters.cors.allowedHttpMethods line in base.conf
• Move http://localhost:5173 from base.conf to devandtest.conf so localhost origin is not allowed in production

Addresses review feedback from #963.

Test plan

• Verify production config only allows apibuilder.io and apibuilder.org origins
• Verify local dev still allows localhost:5173 via devandtest.conf override

🤖 Generated with Claude Code

[Copilot]

Pull request overview

Updates Play CORS configuration to avoid allowing localhost origins in production and removes redundant config duplication.

Changes:

• Remove duplicated play.filters.cors.allowedHttpMethods entry from base.conf.
• Restrict production play.filters.cors.allowedOrigins to the app.apibuilder.io / app.apibuilder.org origins only.
• Add http://localhost:5173 to CORS allowed origins in devandtest.conf (dev/test only).

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
api/conf/base.conf	Removes duplicate allowedHttpMethods line and removes localhost from the base (production-inherited) allowed origins list.
api/conf/devandtest.conf	Adds a dev/test override for allowedOrigins including http://localhost:5173.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

devandtest.conf fully redefines play.filters.cors.allowedOrigins, duplicating the two production origins from base.conf. This can drift if the base list changes (e.g., adding/removing a prod origin) and dev/test won’t automatically inherit it. Prefer appending just the localhost origin to the existing list (e.g., via HOCON list append) so dev/test stays aligned with base by default.

Suggested change

	play.filters.cors.allowedOrigins = [
	"https://app.apibuilder.io",
	"https://app.apibuilder.org",
	"http://localhost:5173"
	]
	play.filters.cors.allowedOrigins += [
	"http://localhost:5173"
	]