da50d78406
Closes P0 #5 from PARTIAL to RESOLVED. Sweeps the remaining 24 pages/api/** handlers that carried the identical scaffolded wildcard-CORS + OPTIONS preflight pattern (Brief 4 cleaned login + register; this finishes the job). Adds a blocking forbidden-cors-headers CI job modeled on forbidden-endpoints to lock the cleanup against future regression. 25 files changed (+29/-261). Local: lint 128 baseline, vitest 21/21, zero CORS matches, YAML valid. CI: Playwright smoke 3/3 in 3.3s against post-removal preview (login/verify flow still works), new forbidden-cors-headers job passes in 4s, all gates green. PR #19 architect-commit |
||
|---|---|---|
| .. | ||
| admin | ||
| auth | ||
| cards | ||
| collections | ||
| community | ||
| config | ||
| decks | ||
| invite | ||
| public | ||
| user | ||
| users | ||
| auth-utils.js | ||
| collections.js | ||
| decks.js | ||
| favorites.js | ||
| health.js | ||
| user-cards.js | ||