Feature/cors origin validation

[d3v-active]

Closes #211

This change adds a safety check that prevents the application from starting in production when the CORS_ORIGINS environment variable is not set.

What was added

1. Exported bootstrap from src/main.ts so it can be invoked directly in tests.
2. Production validation inside bootstrap:
   • Retrieves NODE_ENV and, if it is 'production', verifies that CORS_ORIGINS is defined.
   • Throws an explicit error CORS_ORIGINS must be set in production if the variable is missing, causing the process to abort early.
3. Updated e2e tests (test/security.e2e-spec.ts):
   • Imported the exported bootstrap.
   • Added a new test suite Bootstrap validation that checks the bootstrap aborts with the expected error when CORS_ORIGINS is unset in production.
   • Restores original environment variables after the test.

Why this matters

• Previously, a missing CORS_ORIGINS in production resulted in the server silently booting with an empty CORS whitelist. Every cross‑origin request then failed with a generic “Not allowed by CORS” message, making troubleshooting difficult and potentially causing downtime during critical humanitarian deployments.
• The new validation fails fast, surface‑ing configuration errors during deployment instead of at runtime, which improves reliability and operational confidence.

Verification

• All existing tests continue to pass.
• The new test confirms that bootstrap() rejects with an error containing CORS_ORIGINS when the variable is missing in production mode.

[kilodesodiq-arch]

@d3v-active resolve conflicts please