pub fn router(state: SharedState) -> RouterExpand description
Build the Axum router with an EXPLICIT CORS allowlist (audit fix
HC-05). The previous CorsLayer::permissive() set
Access-Control-Allow-Origin: * which lets any webpage make
authenticated cross-origin calls once a bearer is leaked.
Default allowlist: http://localhost:5173 (the homecore-frontend
Vite dev server) plus the same on port 3000 / 8080 / 8081 / 8123
covering the most common reverse-proxy + HA-app paths. Production
deployments should set HOMECORE_CORS_ORIGINS=https://... (comma-
separated) to override.