shinchan-zhai f26a69d222 security: configurable CORS origins, limit sentinel response body ...

- Add CORS_ALLOWED_ORIGINS config (comma-separated origins, default allow-all)
- CORS middleware now validates Origin header against allowlist
- Add io.LimitReader to sentinel.go (was unbounded, now 256KB)
- Include previous: agent chat auth middleware + frontend token header

2026-03-23 09:53:49 +08:00

..

config.go

security: configurable CORS origins, limit sentinel response body

2026-03-23 09:53:49 +08:00