fix(security): stop granting every origin credentialed access to the API (#5)

`AURUM_CORS_ORIGINS` defaults to `*`, and the middleware was configured with
`allow_credentials=True`. Starlette does not answer that combination with a
literal `*` — it echoes back whatever `Origin` the caller sent and adds
`Access-Control-Allow-Credentials: true`, so any page open in the same
browser can call the instance, with the user's Basic Auth attached, and read
the response:

    GET /api/accounts   Origin: https://evil.example
    -> Access-Control-Allow-Origin: https://evil.example
       Access-Control-Allow-Credentials: true

That undercuts the README's advice that leaving Basic Auth off is fine while
the instance is only reachable from localhost: reachable-from-localhost
includes every website the user visits.

Nothing in the shipped setup is cross-origin. Compose serves the UI and the
API from the same nginx, and the Vite dev server proxies `/api`
(frontend/vite.config.ts), so neither deployment nor development needs CORS
at all. The default is therefore empty — no cross-origin access — and the
middleware is only installed when origins are configured deliberately.

An explicit `*` is still honoured for a genuinely public read-only setup, but
never together with credentials, which is what the spec intends `*` to mean
anyway.

backend/app/core/config.py

@@ -22,8 +22,11 @@ class Settings(BaseSettings):
     # Default currency shown across the UI when an account doesn't override it
     default_currency: str = "USD"
 
-    # Comma-separated list of origins allowed to call the API (frontend dev server, etc.)
-    cors_origins: str = "*"
+    # Comma-separated list of browser origins allowed to call the API. Empty
+    # by default, which allows none: the shipped compose serves the UI and the
+    # API from one nginx, and the Vite dev server proxies /api, so neither is
+    # a cross-origin caller. Set it only for a genuinely separate frontend.
+    cors_origins: str = ""
 
     # CoinGecko Demo API key (free, no card required — https://www.coingecko.com/en/api/pricing)
     # for services/crypto_service.py's price lookups. Empty by default; the