[clbotdev]

The API reference at https://medialit.cloud/docs/api has a "Try it" panel that calls api.medialit.cloud from the browser. Only /media/create and resumable uploads sent CORS headers, so every other endpoint failed its preflight, and "Try it" didn't work for most of the API.

One CORS rule in app.ts now covers /health, /media and /settings/media:

Endpoints	Allowed origins	Why
/media/create, /media/create/resumable*	any	Browsers upload from customers' own sites with a short-lived signature. Same as before.
Everything else (get, list, count, size, seal, delete, signature, settings, health)	https://medialit.cloud only	These need an API key, which belongs on a server. Only the docs' "Try it" panel calls them from a browser, so other sites trying it fail straight away instead of quietly putting a key in front-end code.

• The per-route cors() calls on the upload routes are gone, because the app-level rule now covers them.
• The cookie-based dashboard API under /api/... stays same-origin. The dashboard and the medialit SDK don't call the restricted endpoints from a browser: the dashboard goes through its own /api/apps/... routes, and the SDK runs on the server.

rest-cors.test.ts runs against the real app and checks that:

• the docs origin can preflight the API-key endpoints with x-medialit-apikey;
• another origin can't;
• any origin can preflight the upload endpoints, including resumable ones and with a query string;
• /api/apps doesn't allow other origins.

All 149 API tests, typecheck and lint pass.

Separately: bun run swagger:generate on main adds a content-length header parameter to swagger_output.json. That's existing drift that this change doesn't cause, so it's left out of this PR.