fix: enforce CORS config and prevent path traversal in model loading

[RinZ27]

main.py had a CORS middleware being added twice, with the first call at the top of the file hardcoding * and overriding any user-provided --allowed-origins from the CLI. This update moves the middleware initialization to the main block, ensuring it respects the parsed arguments.

Default value for allowed_origins is now set to http://localhost:3000 to avoid exposing the backend by default on non-local networks.

Additionally, get_model_info in static_config.py now uses Path(name).resolve() and includes a .is_dir() check. This prevents arbitrary file access and ensures the loader only attempts to read from valid directories, reducing the risk of directory traversal when initializing models via the /scheduler/init endpoint.