feat: add CORS management to bucket provisioner plugin

- Add per-call allowedOrigins override to BucketProvisioner.provision()
- Add updateCors() method for CORS-only updates on existing buckets
- Export UpdateCorsOptions type from bucket-provisioner package
- Update graphile plugin with 3-tier CORS resolution hierarchy:
  bucket-level > storage_module-level > plugin config
- Wrap update* mutations on @storagebuckets tables to detect
  allowed_origins changes and re-apply CORS rules
- Read allowed_origins from bucket row in provisionBucket mutation
- Support wildcard CORS (['*']) for CDN/public buckets
- Add 8 new tests for CORS hierarchy, update hooks, error handling
- All 54 plugin tests + 84 bucket-provisioner tests passing

Author: pyramation