docs(cors): which list auth reads, said precisely

OS_TRUSTED_ORIGINS stays auth's own list and admits nothing to CORS. Auth
also trusts every origin listed in OS_CORS_ORIGIN, so that one variable
covers a cross-origin front-end that signs in; a list given through the
plugin's cors.origins option is not seen by auth, so such a front-end is
then also named in OS_TRUSTED_ORIGINS. Changeset and HARDENING.md § CORS.

Claude-Session: https://claude.ai/code/session_01LmjU2x1faLZ39DVTFyVca6
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

.changeset/24738-cors-default-no-cross-origin-caller.md

@@ -14,4 +14,4 @@ Clause-②: no (narrowing)
 - **Now.** With no list, no cross-origin caller is admitted. A loopback origin (`localhost`, `127.0.0.1`, `[::1]`, any port) is admitted on a development boot only: `NODE_ENV` exactly `development`, which `os dev` and `os serve --dev` set. A list that contains `'*'` while credentials are on is refused in `init()`, so the boot fails, and the message names both remedies.
 - **Unchanged.** Same-origin requests need no CORS answer, so the Console under `/_console` and every page the server itself serves work as before. A configured list, exact origins or wildcard patterns, is admitted exactly as before, credentials included. `'*'` with credentials off still boots. `cors: false` and `OS_CORS_ENABLED=false` still disable the middleware. Allowed and exposed headers, methods and max-age are unchanged.
 
-**What an operator does.** A front-end served from another origin that calls this server is now named: `OS_CORS_ORIGIN=https://app.example.com` (comma-separated for several), or the plugin's `cors.origins` option. A boot that now refuses `'*'` either names its origins or sets `OS_CORS_CREDENTIALS=false` to keep serving `'*'` without credentials. `OS_TRUSTED_ORIGINS`, auth's callback and CSRF list, admits nothing to CORS: a cross-origin front-end that signs in belongs in both lists.
+**What an operator does.** A front-end served from another origin that calls this server is now named: `OS_CORS_ORIGIN=https://app.example.com` (comma-separated for several), or the plugin's `cors.origins` option. A boot that now refuses `'*'` either names its origins or sets `OS_CORS_CREDENTIALS=false` to keep serving `'*'` without credentials. `OS_TRUSTED_ORIGINS` is auth's own list, the origins it accepts for callbacks and CSRF checks, and it admits nothing to CORS. Auth also trusts every origin listed in `OS_CORS_ORIGIN`, so that one variable covers a cross-origin front-end that signs in. A list given through the plugin's `cors.origins` option instead is not seen by auth, so such a front-end is then also named in `OS_TRUSTED_ORIGINS`.

docs/HARDENING.md

@@ -212,9 +212,12 @@ variable:
 OS_CORS_ORIGIN=https://app.example.com
 ```
 
-`OS_TRUSTED_ORIGINS` is a different list — the origins auth accepts for
-its callbacks and CSRF checks — and admits nothing to CORS. A
-cross-origin front-end that signs in belongs in both.
+`OS_TRUSTED_ORIGINS` is auth's own list — the origins it accepts for
+its callbacks and CSRF checks — and it admits nothing to CORS. Auth
+also trusts every origin listed in `OS_CORS_ORIGIN`, so that one
+variable covers a cross-origin front-end that signs in. A list given
+through the plugin's `cors.origins` option instead is not seen by
+auth, so such a front-end is then also named in `OS_TRUSTED_ORIGINS`.
 
 Composing the Hono adapter yourself, name the origins there as well: