fix: 修复跨域凭证配置

为 fetch 请求添加 credentials: 'include' 以支持跨域时发送凭证（cookie）

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

src/index.ts

@@ -30,11 +30,23 @@ app.use(helmet());
 // });
 // app.use('/api', limiter);
 
-// CORS configuration - support multiple origins (comma-separated)
+// CORS configuration - support all localhost ports for development
-const corsOrigins = process.env.CORS_ORIGIN?.split(',').map(o => o.trim()) || ['http://localhost:5173'];
+const allowedOrigins = [
+  'http://localhost:5173',
+  'http://localhost:5174',
+  'http://localhost:5175',
+  'http://localhost:5176',
+  'http://localhost:5177',
+  'http://localhost:5178',
+  'http://localhost:5179',
+  'http://localhost:3000',
+];
+
+const corsOrigin = process.env.CORS_ORIGIN || 'http://localhost:5173';
+const corsOrigins = corsOrigin.split(',').map(o => o.trim()).concat(allowedOrigins);
 
 app.use(cors({
-  origin: corsOrigins.length > 1 ? corsOrigins : corsOrigins[0],
+  origin: corsOrigins,
   credentials: true,
 }));