Replace permissive CORS with configurable allowed origins #7

Problem#

main.rs:115 uses CorsLayer::permissive() which allows any origin to make cross-origin requests to the registry API. While this simplifies development, in production it allows any website to make authenticated requests to the registry if a user has credentials cached in their browser.

Proposed Solution#

• Add a --cors-origins CLI argument accepting a comma-separated list of allowed origins
• Default to no CORS headers (or same-origin only) when not specified
• Keep a --cors-permissive flag for development convenience
• Apply the configured CORS policy in the middleware layer

Impact#

Low risk since OCI clients (docker, crane, etc.) don't use browsers, but it's good security hygiene for the admin API and Swagger UI.