feat: dynamic per-site CORS for public banner endpoints

DynamicCORSMedium middleware resolves the calling site's registered
domains (Site.domain + Site.additional_domains) and returns the
appropriate Access-Control-Allow-Origin header for banner script
requests to public endpoints:

- GET /api/v1/config/sites/{site_id}
- GET /api/v1/translations/{site_id}/{locale}
- POST /api/v1/consent/

Instead of hardcoding ALLOWED_ORIGINS env var, each merchant website
automatically gets CORS access as long as its domain is registered
in the site configuration.

apps/api/src/main.py

@@ -10,6 +10,7 @@ from src.config.settings import get_settings
 from src.extensions.registry import discover_extensions, get_registry
 from src.middleware.rate_limit import RateLimitMiddleware
 from src.middleware.security_headers import SecurityHeadersMiddleware
+from src.middleware.dynamic_cors import DynamicCORSMedium
 from src.routers import (
     auth,
     compliance,
@@ -116,7 +117,10 @@ def create_app() -> FastAPI:
             auth_requests_per_minute=10,
         )
 
-    # CORS
+    # CORS — DynamicCORSMedium must come BEFORE CORSMiddleware so it can
+    # add per-site allowed origins for public banner endpoints
+    app.add_middleware(DynamicCORSMedium)
+
     app.add_middleware(
         CORSMiddleware,
         allow_origins=settings.allowed_origins_list,