test: lock CORS preflight allows write methods

The CORS defaults already ship correct (`["*"]`), but nothing guarded
the preflight contract. Add a regression test that sends an
`OPTIONS /api/decks/` preflight from the shipped dev origin
(`http://localhost:5173`) and asserts `POST`/`PUT` appear in
`Access-Control-Allow-Methods`, exercising the real
settings → lite-bootstrap → Starlette CORS middleware wiring.

Ported from modern-python/litestar-sqlalchemy-template#34. Verified it
fails (preflight 400, POST absent) if the methods default regresses to
`[""]`.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: lesnik512

tests/test_cors.py

@@ -0,0 +1,19 @@
+from typing import TYPE_CHECKING
+
+
+if TYPE_CHECKING:
+    from httpx import AsyncClient
+
+
+async def test_cors_preflight_allows_write_methods(client: AsyncClient) -> None:
+    response = await client.options(
+        "/api/decks/",
+        headers={
+            "Origin": "http://localhost:5173",
+            "Access-Control-Request-Method": "POST",
+        },
+    )
+
+    allow_methods = response.headers.get("access-control-allow-methods", "")
+    assert "POST" in allow_methods
+    assert "PUT" in allow_methods