fix: toFloat handles json.Number, CORS credentials+wildcard bug, strategy config error handling

- agent/agent.go: toFloat() now handles json.Number and int32 types to prevent silent data loss
- api/server.go: CORS fix — echo specific origin instead of '*' when credentials are enabled (browsers reject Allow-Credentials with wildcard)
- api/strategy.go: all 4 json.Unmarshal calls now check errors and return 'config_error' field instead of silently serving zero-value configs
- store/decision.go: explicitly mark best-effort unmarshal with _ = assignment for clarity

agent/agent.go

@@ -7,6 +7,7 @@ package agent
 
 import (
 	"context"
+	"encoding/json"
 	"fmt"
 	"log/slog"
 	"net/http"
@@ -548,7 +549,9 @@ func toFloat(v interface{}) float64 {
 	case float32: return float64(x)
 	case int: return float64(x)
 	case int64: return float64(x)
+	case int32: return float64(x)
 	case string: f, _ := strconv.ParseFloat(x, 64); return f
+	case json.Number: f, _ := x.Float64(); return f
 	}
 	return 0
 }