CORS allows all origins (`*`) with credentials

[RonaldRonnie]

Description:

SecurityConfig and UserController allow all origins:

• CorsConfiguration uses setAllowedOriginPatterns(Arrays.asList("*")) with setAllowCredentials(true). This combination is insecure and can lead to credential leakage.
• UserController has @CrossOrigin(origins = "*"), which is redundant and overly permissive.

CORS should restrict origins to known frontends (e.g. from config/env).

Acceptance criteria:

• CORS allowed origins come from configuration (e.g. CORS_ALLOWED_ORIGINS in env) and are not * when credentials are allowed
• Remove @CrossOrigin(origins = "*") from controllers; rely on global CORS config only