- CORS config is now actually applied to the router (the middleware
existed but was never wired); preflight returns 204 for allowed
origins and 403 with no CORS headers for disallowed ones.
- /readyz runs real dependency checks (queue, auth database) and
returns 503 with per-component detail when not ready; exported
handlers support dedicated health listeners.
- Optional server.tls (cert_file/key_file) for REST and gRPC, validated
at config load.
- 5xx responses no longer echo internal error details; not-found and
already-sent map to 404/409 on cancel/retry.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
After conflict resolution from rebase, some imports were accidentally
removed and the CORS middleware function was eliminated but still
referenced by tests. This commit:
- Adds fmt import to api/rest/keys.go (used for error messages)
- Adds gorilla/mux import to cmd/server/main.go (used for router type)
- Restores newCORSMiddleware function to api/rest/router.go for test compatibility
- Formats code with gofmt
igodwin