docs(backend): CORS security invariant — credentialed reflection only while credential-less

The example backend's reflected-origin + allow-credentials pairing is safe
solely because this server holds no ambient credentials by design (default
origin is the explicit :3048; '*' is an operator opt-in). Make that a stated
invariant so adding any auth here forces revisiting the wildcard mode.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016TxciQ5VkNYUZesgMSEMUr

web/backend/src/server.ts

@@ -153,6 +153,13 @@ async function main(): Promise<void> {
     // `true` REFLECTS the request origin (never the literal `*`), so it stays
     // valid for the editor's credentialed fetches; allow-credentials is what
     // lets the browser accept those responses (cookie-less callers unaffected).
+    //
+    // SECURITY INVARIANT: reflected-origin + allow-credentials is safe ONLY
+    // while this example backend holds no ambient credentials (no cookies, no
+    // sessions, no auth — which is its whole design; default origin is the
+    // explicit :3048, `*` is an operator opt-in). If any credentialed auth is
+    // ever added here, the `*` reflection mode MUST go — allow only explicit
+    // origin lists.
     origin: CORS_ORIGIN === "*" ? true : CORS_ORIGIN.split(","),
     credentials: true,
   });