feat: add MaxAge preflight cache support to AllowCORS

[ghosthouse7]

Closes #125

Changes

• Modified cors.go to add MaxAge support to AllowCORS
• Added CORSConfig struct with MaxAge field
• If MaxAge > 0, sets Access-Control-Max-Age header
  on preflight OPTIONS responses
• Defaults to 0 (disabled) — fully backwards compatible

Usage

// Basic usage (unchanged)
app.Use(AllowCORS([]string{"*"}))

// With MaxAge preflight caching
app.Use(AllowCORS([]string{"*"}, vodka.CORSConfig{
MaxAge: 86400, // cache preflight for 24 hours
}))

Why This Matters

• Browsers currently send a preflight OPTIONS request
  on every single API call
• With MaxAge set, browsers cache the preflight
  response and skip redundant requests
• Reduces latency and unnecessary network overhead
• Zero breaking changes to existing AllowCORS usage

Files Changed

• cors.go (modified)

[vercel]

@ghosthouse7 is attempting to deploy a commit to the Devanshu Tripathi's projects Team on Vercel.

A member of the Team first needs to authorize it.

[DevanshuTripathi]

@ghosthouse7 Can you write tests for it

[ghosthouse7]

def! just give me some time

[DevanshuTripathi]

Hi @ghosthouse7 Just checking to see if you are active on this PR

[ghosthouse7]

yeah yeah on it, will be raising a pr very soon.

[ghosthouse7]

Hey @DevanshuTripathi, added the tests! Here's what's covered:

TestCORSAllowsMaxAge — verifies MaxAge: 86400 sets the header correctly on preflight
TestCORSMaxAgeZeroOmitsHeader — verifies MaxAge: 0 doesn't set the header (backwards compat)
TestCORSMaxAgeNotSetOnNonPreflight — verifies regular requests don't get the header
TestCORSMaxAgeBlockedForDisallowedOrigin — verifies blocked origins get 403 and no header

All tests passing ✅

[DevanshuTripathi]

LGTM