Fix CORS config: wildcard origins with credentials is unsafe

[yuuka-dev]

Copilot review #6: CORS allow_origins=['*'] + allow_credentials=True is unsafe. Either disable credentials for wildcard or restrict origins.