fix: set CORS to wildcard for public API access

[Sagargupta16]

Summary

• Set CORS allow_origins to ["*"] so any frontend domain can access the API (fixes 404/CORS errors from sagargupta.online -> ledger-sync.onrender.com)
• Set allow_credentials=False (required by CORS spec when using wildcard origin -- auth still works via Authorization bearer header)
• Allow all methods and headers (["*"])

Test plan

• Verify https://sagargupta.online can upload files to https://ledger-sync.onrender.com/api/upload without CORS errors
• Verify API calls from any origin return proper Access-Control-Allow-Origin: * header
• Verify JWT auth still works via Authorization header

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud