security: configurable CORS origins, limit sentinel response body

- Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all)
- CORS middleware now validates Origin header against allowlist
- Add io.LimitReader to sentinel.go (was unbounded, now 256KB)
- Include previous: agent chat auth middleware + frontend token header

agent/sentinel.go

@@ -115,7 +115,7 @@ func (s *Sentinel) check(symbol string) {
 	resp, err := s.http.Get(fmt.Sprintf("https://fapi.binance.com/fapi/v1/ticker/24hr?symbol=%s", symbol))
 	if err != nil { return }
 	defer resp.Body.Close()
-	body, err := io.ReadAll(resp.Body)
+	body, err := io.ReadAll(io.LimitReader(resp.Body, 256*1024)) // 256KB limit
 	if err != nil { return }
 	var t map[string]interface{}
 	if err := json.Unmarshal(body, &t); err != nil { return }

agent/stock.go

@@ -133,7 +133,7 @@ func searchStock(keyword string) ([]SearchResult, error) {
 	}
 	defer resp.Body.Close()
 
-	reader := transform.NewReader(resp.Body, simplifiedchinese.GBK.NewDecoder())
+	reader := transform.NewReader(io.LimitReader(resp.Body, 256*1024), simplifiedchinese.GBK.NewDecoder())
 	body, err := io.ReadAll(reader)
 	if err != nil {
 		return nil, err