add CORS manager with relative docs

config/config.php.template

@@ -1,10 +1,49 @@
 <?php
 return [
     'elixforms_api_base_url' => 'https://api.example.com',
+
     'rate_limiter_driver' => 'file', // o 'memory'
     // configuration for file-based rate limiter
     'rate_limit_storage_dir' => sys_get_temp_dir() . '/api_rate_limit',
     // configuration for memory-based rate limiter
     'rate_limit_requests' => 100,
     'rate_limit_window_seconds' => 60,
+
+    'cors' => [
+        'enabled' => true,
+        // Allowed origins - requests from other origins will be rejected
+        'allowed_origins' => [
+            'http://localhost:3000',      // Local development - frontend
+            'http://localhost:8080',      // Local development - alternative port
+            'https://app.example.com',    // Production frontend
+            'https://admin.example.com',  // Production admin panel
+            // 'http://localhost:*',      // Allow any port on localhost (not recommended)
+            // '*'                        // Allow all origins (HIGHLY NOT RECOMMENDED for production)
+        ],
+        // HTTP methods allowed for CORS requests
+        'allowed_methods' => ['GET', 'POST', 'PUT', 'DELETE', 'PATCH', 'OPTIONS'],
+        // HTTP headers allowed in the request
+        'allowed_headers' => [
+            'Content-Type',
+            'Authorization',
+            'X-Requested-With',
+            'Accept',
+            'Accept-Language',
+            'Content-Language',
+            'X-API-Key',
+        ],
+        // HTTP headers exposed to the client
+        'exposed_headers' => [
+            'Content-Length',
+            'X-JSON-Response-Code',
+            'X-Rate-Limit-Limit',
+            'X-Rate-Limit-Remaining',
+            'X-Rate-Limit-Reset',
+        ],
+        // Allow credentials (cookies, authorization headers) in cross-origin requests
+        // Only set to true if you understand the security implications
+        'allow_credentials' => false,
+        // How long (in seconds) the browser can cache the preflight response
+        'max_age' => 86400, // 24 hours
+    ],
 ];