fix(worker): restrict CORS to configured origins; comply with npm-avoidant policy

Follow-up fixes for CI findings on PR #19:

- Security (CWE-942 / Hypatia js_wildcard_cors, critical): replace the hardcoded
  wildcard Access-Control-Allow-Origin with an env-configurable allowlist
  (CORS_ALLOW_ORIGIN), defaulting to the portal origin. CORS headers are now
  applied centrally in fetch(); request Origin is echoed only when allowlisted.
  Added 3 CORS tests (default origin, echo-allowed, never-wildcard).

- Governance (npm-avoidant policy / standards JS-RUNTIME-POLICY): stop tracking
  worker/package-lock.json (now gitignored) and pin devDependencies to exact
  versions for reproducibility; CI uses `npm install` instead of `npm ci`.

- Workflows: add timeout-minutes to worker-ci, worker-deploy and boj-build
  (Hypatia workflow_audit).

Verified: 33/33 tests pass, eslint + prettier clean, wrangler dry-run OK,
no tracked package-lock.json.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01UCnxjXkN6uDj9YSANuGEgR

Author: claude

.github/workflows/boj-build.yml

@@ -7,6 +7,7 @@ on:
 jobs:
   trigger-boj:
     runs-on: ubuntu-latest
+    timeout-minutes: 5
     steps:
       - name: Checkout
         uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

.github/workflows/worker-ci.yml

@@ -26,6 +26,7 @@ jobs:
   build-test:
     name: Lint, format, test, bundle
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     steps:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -34,11 +35,10 @@ jobs:
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: '22'
-          cache: npm
-          cache-dependency-path: worker/package-lock.json
 
+      # No tracked package-lock.json (npm-avoidant policy) → npm install, not npm ci.
       - name: Install dependencies
-        run: npm ci
+        run: npm install --no-audit --no-fund
 
       - name: Lint (eslint)
         run: npm run lint

.github/workflows/worker-deploy.yml

@@ -34,6 +34,7 @@ jobs:
   deploy:
     name: Deploy
     runs-on: ubuntu-latest
+    timeout-minutes: 15
     # Manual dispatch picks the env (production requires approval if the
     # "production" GitHub Environment has protection rules); push → staging.
     environment: ${{ github.event_name == 'workflow_dispatch' && inputs.environment || 'staging' }}
@@ -45,11 +46,10 @@ jobs:
         uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
         with:
           node-version: '22'
-          cache: npm
-          cache-dependency-path: worker/package-lock.json
 
+      # No tracked package-lock.json (npm-avoidant policy) → npm install, not npm ci.
       - name: Install dependencies
-        run: npm ci
+        run: npm install --no-audit --no-fund
 
       - name: Test before deploy
         run: npm test

worker/.gitignore

@@ -1,5 +1,8 @@
 # Node toolchain (dev-only; not part of the deployed Worker)
 node_modules/
+# npm lockfiles are not tracked (hyperpolymath npm-avoidant policy);
+# devDependencies are pinned to exact versions in package.json instead.
+package-lock.json
 # Wrangler local dev / Miniflare state
 .wrangler/
 # Test coverage