PB: CORS middleware allows wildcard origin combined with AllowCredentials=true

[mushrafmim]

Describe the Bug

internal/pb/v1/middleware/cors.go:67-81 sends Access-Control-Allow-Origin: * when AllowedOrigins contains "*", and separately sends Access-Control-Allow-Credentials: true whenever config.AllowCredentials is true — with no validation preventing both being set together. Surfaced by CodeRabbit reviewing #517 — this code predates that PR, it just moved location (was portal-backend/v1/middleware/cors.go).

Per the Fetch spec, a browser rejects a credentialed CORS response that carries a wildcard Access-Control-Allow-Origin. If someone sets CORS_ALLOWED_ORIGINS=* (as shown as an example in cmd/pb/README.md) alongside credentialed auth, authenticated cross-origin portal requests silently fail in the browser even though the server-side response looks fine.

To Reproduce

1. Configure AllowedOrigins: []string{"*"} and AllowCredentials: true.
2. Make a credentialed cross-origin request (e.g. with cookies or Authorization header expecting withCredentials/credentials: 'include').
3. The browser rejects the response due to the wildcard-origin + credentials combination, even though the server returned 200.

Expected Behavior

Reject or otherwise invalidate the configuration when AllowedOrigins contains "*" and AllowCredentials is true (e.g. fail config validation, or require explicit trusted origins in that case), so this misconfiguration is caught before deployment rather than surfacing as an inexplicable browser-side CORS failure. Add test coverage for the invalid combination.

Version

Surfaced on PR #517 (refactor/portal-backend-restructure).

Additional Context

Flagged 🟠 Major (Functional Correctness) by CodeRabbit.