fix(cors): enable preflight for Capacitor WebView requests

Add express cors middleware with reflected origin so Android clients
from https://localhost receive Access-Control-Allow-* headers on
OPTIONS and can proceed with POST requests.

package.json

@@ -12,12 +12,14 @@
     "@peculiar/asn1-ecc": "^2.3.8",
     "@peculiar/asn1-schema": "^2.3.8",
     "cbor-x": "^1.5.9",
+    "cors": "^2.8.6",
     "did-jwt": "^7.4.7",
     "did-resolver": "^4.1.0",
     "express": "^5.1.0",
     "firebase-admin": "^13.9.0"
   },
   "devDependencies": {
+    "@types/cors": "^2.8.19",
     "@types/express": "^5.0.0",
     "@types/node": "^22.10.0",
     "tsx": "^4.19.2",