feat: implement CORS support and update API_URL in environment configuration

api/src/index.js

@@ -12,6 +12,21 @@ const vState = process.env.VERSION_STATE;
 app.use(express.json());
 app.use(parser());
 
+// CORS per permettere chiamate cross-origin dalla console
+app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    const allowed = (process.env.CORS_ORIGINS || '').split(',').map(s => s.trim()).filter(Boolean);
+    // Accetta origini nella whitelist, oppure tutte in dev
+    if (allowed.length === 0 || allowed.includes(origin)) {
+        res.setHeader('Access-Control-Allow-Origin', origin || '*');
+    }
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PUT, PATCH, DELETE, OPTIONS');
+    res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization, x-api-key');
+    res.setHeader('Access-Control-Allow-Credentials', 'true');
+    if (req.method === 'OPTIONS') return res.sendStatus(204);
+    next();
+});
+
 app.get('/', (req, res) => {
     res.redirect('/health');
 });