CORS preflight

Browser preflight for cross-origin calls (publishable keys embedded on other sites). Always 204 with permissive headers — Access-Control-Allow-Origin: *, methods GET, OPTIONS, headers Authorization, Content-Type. A preflight carries no Authorization header, so it can't be token-aware; the real enforcement (origin allowlist, scope narrowing, rate limits) happens on the GET.