Fix wildcard CORS + credentials misconfiguration in FastAPI backend #1

Summary
The backend currently allows requests from any origin while also allowing credentials, which is an unsafe CORS configuration for a service that has cookie-based authentication elsewhere in the stack. This issue replaces the wildcard origin with an explicit, environment-driven allowlist.

Why this matters
main.py sets allow_origins=["*"] together with allow_credentials=True. Wildcard origin combined with credentialed requests is a configuration most security tooling flags outright, and the stack has Clerk cookie-based auth elsewhere in the frontend. This means credentialed cross-origin requests may currently be reachable from any origin. This is a live, production-facing security gap and should be the first fix made to the repository.

Acceptance Criteria

• allow_origins reads from an explicit env-driven allowlist (CORS_ORIGINS, already defined in .env.example but unused in code) instead of "*"

• allow_credentials=True only applies to the allowlisted origins

• A regression test or manual curl script confirms a non-allowlisted Origin header does not receive Access-Control-Allow-Origin in the response

• Local dev (localhost:3000) and the deployed Vercel origin both continue to work without errors

Files to Modify

finverify-terminal/backend/app/main.py
finverify-terminal/backend/.env.example

Skills Required
Python
FastAPI
HTTP/CORS fundamentals
Web security basics

Estimated Effort
2–4 hours

Suggested Labels
security backend priority:critical good first issue

References

finverify-terminal/backend/app/main.py (CORSMiddleware configuration); finverify-terminal/backend/.env.example (existing but unused CORS_ORIGINS variable).