hotfix(v1.7.8): restore CORS wildcard and fix CSP for MSAL auth
- Revert automatic CORS wildcard stripping that broke production deployments with CORS_ORIGINS=* (now logs a warning but preserves the config) - Expand CSP headers to allow MSAL auth flows: - connect-src: login.microsoftonline.com - frame-src: login.microsoftonline.com - form-action: login.microsoftonline.com
This commit is contained in: