Acknowledge CORS security note is sufficient for development

[Copilot]

Addressed review feedback on PR #17 regarding CORS configuration security concern. The existing TODO comment on line 22 of app/main.py already documents that origins should be restricted for production use, making the current development configuration acceptable.

No code changes required - the TODO note adequately addresses the security consideration:

# TODO: Restrict origins for production use
app.add_middleware(
    CORSMiddleware,
    allow_origins=["*"],
    allow_credentials=True,
    ...
)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.