fix: 过滤非法 CORS Origin，避免 Docker 启动 panic

gin-contrib/cors 不接受 tauri://，启动时过滤仅保留 http/https。

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/middleware/cors.go

@@ -2,6 +2,7 @@ package middleware
 
 import (
 	"backend/config"
+	"strings"
 	"time"
 
 	"github.com/gin-contrib/cors"
@@ -10,7 +11,7 @@ import (
 
 // CORSMiddleware CORS 中间件，使用显式白名单避免携带凭据时放行任意来源。 // Logan.Li
 func CORSMiddleware(cfg *config.Config) gin.HandlerFunc {
-	origins := cfg.CORSOrigins
+	origins := filterHTTPOrigins(cfg.CORSOrigins)
 	if len(origins) == 0 {
 		origins = []string{
 			"http://localhost:5181",
@@ -29,3 +30,18 @@ func CORSMiddleware(cfg *config.Config) gin.HandlerFunc {
 		MaxAge:           12 * time.Hour,
 	})
 }
+
+// filterHTTPOrigins keeps only origins gin-contrib/cors accepts (http/https or *). // Logan.Li
+func filterHTTPOrigins(origins []string) []string {
+	out := make([]string, 0, len(origins))
+	for _, origin := range origins {
+		o := strings.TrimSpace(origin)
+		if o == "" {
+			continue
+		}
+		if o == "*" || strings.HasPrefix(o, "http://") || strings.HasPrefix(o, "https://") {
+			out = append(out, o)
+		}
+	}
+	return out
+}