Fix CORS for Vercel frontend

[gitgrahamdunn]

Motivation

• Allow the Vercel-hosted Vite frontend to call the Vercel-hosted FastAPI backend by fixing CORS and preflight handling.
• Provide a quick verification endpoint to inspect incoming Origin and the configured allowlist/regex.

Description

• Enable CORSMiddleware for all environments in backend/app/main.py with allow_origins including http://localhost:5173, http://127.0.0.1:5173, and https://gitplant-oggy.vercel.app.
• Add allow_origin_regex = r"https://.*\.vercel\.app" to dynamically allow Vercel preview origins and set allow_methods=["*"], allow_headers=["*"], and allow_credentials=False (token-based auth flow, not cookie-based).
• Add a GET /cors-debug endpoint that returns the request Origin, the allowed_origins, the allowed_origin_regex, and allow_credentials for quick verification.
• Update backend/tests/test_dev_and_cors.py to verify OPTIONS preflight handling for both production and preview Vercel origins and to validate /cors-debug output.
• Update README.md with Vercel deployment notes including setting VITE_API_URL and the CORS expectations.

Testing

• Ran cd backend && pytest tests/test_dev_and_cors.py, the initial run failed due to a test string mismatch during development and was corrected.
• After the fix, re-running cd backend && pytest tests/test_dev_and_cors.py resulted in all tests in that file passing (5 passed).

---

Codex Task

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
gitplant	Ready	Preview, Comment	Feb 19, 2026 1:25am
gitplant-backend	Ready	Preview, Comment	Feb 19, 2026 1:25am
gitplant-oggy	Ready	Preview, Comment	Feb 19, 2026 1:25am