Fix backend topic correctness and /topic CORS contracts

[rendall]

Summary

This PR implements the approved Phase 02 checklist for backend correctness and /topic CORS contract alignment.

It addresses four scoped intents:

1. Fix topicDELETE descendant deletion behavior.
2. Fix topicListGET auth validation behavior.
3. Align referer normalization/matching contract across backend code and config docs.
4. Align /topic CORS declarations with implemented route behavior.

Changes

• src/lib/MongodbService.ts

  • Fixed topicDELETE topic lookup to resolve a document (findOne) rather than relying on cursor object truthiness.
  • Fixed descendant deletion to remove both the topic id and graph lookup replies[].id descendants.
  • Fixed topicListGET auth lookup to resolve a user document before policy checks.
  • Updated topic-create referer denial messaging to report normalized allowed patterns consistently.

• src/lib/backend-utilities.ts

  • getAllowedOrigins now trims and filters configured origin entries.
  • Added normalized configured-origin handling for referer matching.
  • isAllowedReferer now matches against both trimmed configured patterns and normalized equivalents to keep advanced glob behavior while enforcing a consistent contract.

• src/functions/topic.ts

  • Updated Access-Control-Allow-Methods to GET,POST,PUT,DELETE,OPTIONS.
  • Updated Access-Control-Allow-Headers to Cookie,Authorization.
  • Ensured OPTIONS responses use the same header construction path as non-preflight responses.

• example.env

  • Updated ALLOW_ORIGIN guidance to document referer-pattern normalization and examples consistent with runtime behavior.

• src/tests/backend/utilities.test.ts

  • Updated referer-pattern expectations to reflect normalized configured-origin contract.

• docs/plans/phase-02-backend-correctness-and-cors.md

  • Completed the 3-pass checklist process (QC, integration, sanity).
  • Marked C01-C08 complete.

Validation

• yarn jest --config jest.backend.config.ts src/tests/backend/utilities.test.ts src/tests/backend/MongodbService.test.ts
• yarn test:backend

Result: backend suites pass (9/9), tests pass (180/180).

Scope Notes

• No governance/process-only changes added beyond checklist-required documentation updates.
• No frontend behavior refactor included.