fix: restrict web server CORS defaults

[rtmalikian]

Summary

• Studied README.md, web_server/README.md, and the FastAPI web server implementation.
• README/docs TODOs found in web_server/README.md: streaming response support, multi-model support, enhanced UI features, performance optimizations, additional language support, and documentation improvements. These were broad/ambiguous for a safe one-change daily run, so I did not implement them.
• Hardened the web server CORS defaults from wildcard origins with credentials enabled to localhost-only trusted origins with credentials disabled.
• Added CORS_ALLOW_ORIGINS as a comma-separated opt-in for deployments that need additional trusted browser origins.
• Added a focused regression test for the default CORS configuration.
• Updated README and web server docs with the new CORS configuration variable.

Security probing

• Performed static inspection for common unsafe patterns in the web server, including permissive CORS, dynamic execution, shell invocation, and secret-like strings.
• Found and fixed the bounded CORS issue in web_server/app.py.
• No secrets are included in this change. Dependency audit via python3 -m pip_audit could not run because pip_audit is not installed in this environment.

Verification

• RED: python3 -m pytest tests/test_web_server_cors.py -q failed before the fix because CORS allowed ["*"].
• GREEN: python3 -m pytest tests/test_web_server_cors.py -q passed after the fix.
• python3 -m py_compile web_server/app.py passed.
• git diff --check passed.

Files changed

• web_server/app.py
• tests/test_web_server_cors.py
• README.md
• web_server/README.md

Limitations

• I did not run the full BitNet build or model inference because the local model/build artifacts are not present and would be expensive for this small config hardening change.
• No CHANGELOG.md exists, so no changelog entry was added.