Fix missing imports and restore CORS middleware for tests

After conflict resolution from rebase, some imports were accidentally
removed and the CORS middleware function was eliminated but still
referenced by tests. This commit:
- Adds fmt import to api/rest/keys.go (used for error messages)
- Adds gorilla/mux import to cmd/server/main.go (used for router type)
- Restores newCORSMiddleware function to api/rest/router.go for test compatibility
- Formats code with gofmt

internal/config/config.go

@@ -224,7 +224,7 @@ func setDefaults(v *viper.Viper) {
 	v.SetDefault("auth.bootstrap.kubernetes_secret_key", "admin-key")           // Default secret key
 
 	// CORS defaults - secure by default (no origins allowed)
-	v.SetDefault("cors.allowed_origins", []string{})                                // Empty by default - must be explicitly configured
+	v.SetDefault("cors.allowed_origins", []string{})                                   // Empty by default - must be explicitly configured
 	v.SetDefault("cors.allowed_methods", []string{"GET", "POST", "OPTIONS", "DELETE"}) // Standard REST methods
 	v.SetDefault("cors.allowed_headers", []string{"Content-Type", "Authorization"})    // Common headers
 	v.SetDefault("cors.allow_credentials", false)                                      // Credentials disabled by default