fix: wildcard CORS for public banner API endpoints

Replace the fragile per-site dynamic CORS middleware with a public banner
CORS middleware that allows non-credentialed wildcard CORS only for banner
endpoints:

- /api/v1/config/sites/*
- /api/v1/translations/*
- /api/v1/consent/

Admin/auth endpoints remain governed by the normal ALLOWED_ORIGINS based
CORSMiddleware. Add regression tests for public GET/preflight behavior and
for avoiding wildcard CORS on non-public endpoints.

apps/api/src/main.py

@@ -8,9 +8,9 @@ from src.config.edition import edition_name
 from src.config.logging import setup_logging
 from src.config.settings import get_settings
 from src.extensions.registry import discover_extensions, get_registry
+from src.middleware.public_banner_cors import PublicBannerCORSMiddleware
 from src.middleware.rate_limit import RateLimitMiddleware
 from src.middleware.security_headers import SecurityHeadersMiddleware
-from src.middleware.dynamic_cors import DynamicCORSMedium
 from src.routers import (
     auth,
     compliance,
@@ -117,10 +117,8 @@ def create_app() -> FastAPI:
             auth_requests_per_minute=10,
         )
 
-    # CORS — DynamicCORSMedium must come BEFORE CORSMiddleware so it can
-    # add per-site allowed origins for public banner endpoints
-    app.add_middleware(DynamicCORSMedium)
-
+    # CORS for admin/auth endpoints. Public banner endpoints get wildcard,
+    # non-credentialed CORS from PublicBannerCORSMiddleware below.
     app.add_middleware(
         CORSMiddleware,
         allow_origins=settings.allowed_origins_list,
@@ -129,6 +127,10 @@ def create_app() -> FastAPI:
         allow_headers=["*"],
     )
 
+    # Add this AFTER CORSMiddleware so it becomes the outermost middleware and
+    # can override/remove credentialed CORS headers for public banner endpoints.
+    app.add_middleware(PublicBannerCORSMiddleware)
+
     # Core routers
     api_prefix = "/api/v1"
     app.include_router(auth.router, prefix=api_prefix)