Function build_cors_layer 

pub fn build_cors_layer() -> CorsLayer

Build the audited CORS allowlist layer (HC-05). Exposed so the integration binary can apply the SAME allowlist to routes merged in outside router() (e.g. the ADR-131 BFF gateway), instead of leaving /api/homecore/* and /api/cal/* with no CORS coverage at all.