feat: add CORS middleware to allow all origins

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server.ts

@@ -21,6 +21,18 @@ router.get("/:did/notes", (ctx) => {
 });
 
 const app = new Application();
+
+app.use(async (ctx, next) => {
+  ctx.response.headers.set("Access-Control-Allow-Origin", "*");
+  ctx.response.headers.set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
+  ctx.response.headers.set("Access-Control-Allow-Headers", "Content-Type, Authorization");
+  if (ctx.request.method === "OPTIONS") {
+    ctx.response.status = 204;
+    return;
+  }
+  await next();
+});
+
 app.use(router.routes());
 app.use(router.allowedMethods());