fix: 过滤非法 CORS Origin，避免 Docker 启动 panic

gin-contrib/cors 不接受 tauri://，启动时过滤仅保留 http/https。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/config/config.go

@@ -48,18 +48,22 @@ func Load() *Config {
 		DBPassword: getEnv("DB_PASSWORD", ""),
 		DBName:     getEnv("DB_NAME", "db.sqlite3"),
 		JWTSecret:  getEnv("JWT_SECRET", ""),
-		CORSOrigins: []string{
-			"http://localhost:5181",
-			"http://127.0.0.1:5181",
-			"http://localhost:3000",
-			"http://127.0.0.1:3000",
-			// OpsXShell Tauri / Vite dev origins
-			"http://localhost:1420",
-			"http://127.0.0.1:1420",
-			"http://tauri.localhost",
-			"https://tauri.localhost",
-			"tauri://localhost",
-		},
+		CORSOrigins: defaultCORSOrigins(),
+	}
+
+	if raw := strings.TrimSpace(os.Getenv("CORS_ORIGINS")); raw != "" {
+		parts := strings.Split(raw, ",")
+		origins := make([]string, 0, len(parts))
+		for _, p := range parts {
+			p = strings.TrimSpace(p)
+			if p == "" {
+				continue
+			}
+			origins = append(origins, p)
+		}
+		if len(origins) > 0 {
+			cfg.CORSOrigins = origins
+		}
 	}
 
 	// 安全检查：生产环境拒绝空密钥，开发环境使用进程级随机密钥避免固定后门。 // Logan.Li
@@ -74,6 +78,20 @@ func Load() *Config {
 	return cfg
 }
 
+func defaultCORSOrigins() []string {
+	return []string{
+		"http://localhost:5181",
+		"http://127.0.0.1:5181",
+		"http://localhost:3000",
+		"http://127.0.0.1:3000",
+		// OpsXShell Tauri / Vite dev origins (gin-cors only accepts http/https)
+		"http://localhost:1420",
+		"http://127.0.0.1:1420",
+		"http://tauri.localhost",
+		"https://tauri.localhost",
+	}
+}
+
 // IsOriginAllowed 判断浏览器 Origin 是否在显式 CORS 白名单中。 // Logan.Li
 func (c *Config) IsOriginAllowed(origin string) bool {
 	for _, allowed := range c.CORSOrigins {