Function build_cors_layer 

pub fn build_cors_layer(origins: &[String]) -> CorsLayer

Build a CORS layer from the configured allowed origins.

• Empty list → same-origin only (no Access-Control-Allow-Origin header).
• ["*"] → fully permissive (all origins, all methods).
• Specific origins → allowlist with credentials support.