feat(admin): update runtime CORS origins consistently

[n30nex]

What this PR does

Add protected PUT /api/v1/admin/config for cors.allowed_origins, the supported runtime-config slice of #60. A valid request replaces the whole list and publishes a rebuilt CORS handler together with the reported settings. Policies are immutable; concurrent updates are applied one at a time, and in-flight requests may finish under the old policy. GET reflects the current settings.

Updates are runtime-only: no file/database write, no restart needed, and restart reloads saved configuration. Responses explicitly return persisted: false and requires_restart: false. Invalid/unauthorized input changes nothing. Other CORS options, auth/credential fields and broker count remain unwritable; this does not invent a configurable ingest.worker_count.

Dependent draft on #146/#147. The branch starts at #147's exact commit; review the focused delta. It does not require the account PRs. Rebase onto accepted prerequisites before leaving draft.

Type of change

• New feature
• Tests
• API documentation

Checklist

• Build, format, vet and full Go tests pass
• Validation, state-copying, enforcement and concurrency tests added
• Swagger regenerated with request/response types and auth requirements
• No dependency or schema change
• CONTRIBUTING.md read

Testing notes

Local and native Pi full checks, CI/CodeQL and focused Windows race tests pass. Tests cover required bounded JSON, unknown/immutable fields, invalid origins, origin normalization, unauthorized updates, unchanged state after errors, actual old/new preflight behavior, copied inputs/results, preserved exposed headers/options, concurrent requests/updates and reset on construction from saved settings. The request path loads the current policy; handlers are rebuilt only for updates.

A private instance of the exact combined binary changed real CORS enforcement and GET results together, retained Retry-After exposure, rejected unsupported updates without changing state, and restored saved defaults after an actual container restart. The key was absent from logs; the private instance/key file were removed without live MQTT. The preview includes this draft with account/rate-limit candidates, matching source, public APIs/WebSockets and advancing feeds. Its admin access remains disabled and its saved config/schema are unchanged.

AI-assisted implementation/testing uses the contributor's standing authorization without claiming a new specific human diff review.

[n30nex]

@MrAlders0n please review this change with your Claude agent as part of the September 13 Beacon review batch. The current candidate is d82a9463e7d8; validation and Pi evidence are in the PR description.

Early review is requested on the focused delta linked in the description. Keep this draft until #146/#147 are accepted and the branch is rebased. Please check atomic CORS enforcement/reporting, rejected updates and restart reset. Issue #60 remains open for remaining configuration scope.