fix: add CORS middleware to allow frontend auth requests

Add CORSMiddleware configured to:
- Allow the frontend origin (web_base_url)
- Allow credentials (cookies)
- Allow all methods and headers

This fixes cross-origin requests between frontend and API
when they're on different subdomains.

apps/api/src/main.py

@@ -2,6 +2,7 @@ import logging
 import os
 
 from fastapi import FastAPI
+from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 from sqlalchemy import select, text
 
@@ -12,6 +13,7 @@ from src.api.ssh_keys import router as ssh_keys_router
 from src.api.tool_types import router as tool_types_router
 from src.api.user_config import router as user_config_router
 from src.api.users import router as users_router
+from src.config import Settings
 from src.database import SessionLocal, init_database
 from src.logging_config import (
     ExceptionLoggingMiddleware,
@@ -25,7 +27,18 @@ log_level = os.getenv("LOG_LEVEL", "INFO").upper()
 configure_logging(level=getattr(logging, log_level, logging.INFO))
 
 logger = logging.getLogger(__name__)
+settings = Settings()
 app = FastAPI(title="Headquarter API")
+
+# Configure CORS - must be before other middleware
+app.add_middleware(
+    CORSMiddleware,
+    allow_origins=[settings.web_base_url],
+    allow_credentials=True,
+    allow_methods=["*"],
+    allow_headers=["*"],
+)
+
 app.add_middleware(RequestLoggingMiddleware)
 app.add_middleware(ExceptionLoggingMiddleware)