CORS preflight for the sandbox explain endpoint

CORS preflight response for the write-side endpoints (/api/v1/sandbox/auth/approval-token, /api/v1/sandbox/actions/plan, /api/v1/sandbox/actions/execute). Differs from SandboxOptionsPreflight in four deliberate ways: (1) Allow-Methods is POST, OPTIONS not GET, OPTIONS; (2) Allow-Headers list includes Authorization (sandbox is auth-gated; browser preflights must allow the header or the cross-origin POST fails CORS before the handler runs); (3) Access-Control-Allow-Credentials: false is set explicitly (Bearer tokens flow cross-origin with credentials=false; only cookies require credentials=true); (4) Max-Age is 86400 (24h, not 1h) — preflight stable across the entire deploy.