Add tests for CORS functionality: - validateCORSConfig (valid and invalid configs) - SetCORSConfig (update and validation) - resolveAllowedOrigin (exact match, wildcard, case insensitive) - CORS middleware (allow/forbid origins, OPTIONS handling) Coverage: middleware 36.4% → 37.4%