fix: restrict CORS origins and gate webhook events endpoint

[cursor]

Summary

Fixes two security vulnerabilities found during an at-rest security scan.

1. HIGH — Wildcard CORS enables cross-origin API key abuse

All four reference servers used cors() with no origin restrictions. Any website a developer visits while running these servers could silently create checkout sessions and initiate charges (Wave, MTN, card) via cross-origin requests — abusing the merchant's secret API key.

Fix: Replace cors() with cors({ origin: appBaseUrl }) on all four servers, restricting cross-origin requests to the app's own frontend origin.

2. MEDIUM — Unauthenticated webhook event endpoint exposes payment data

GET /api/webhooks/events returned the full in-memory webhook log (transaction IDs, amounts, customer PII) with no authentication. Combined with the wildcard CORS, any website could silently exfiltrate this data.

Fix: Add optional ADMIN_TOKEN Bearer auth on the events endpoint. When ADMIN_TOKEN is set in .env, requests must include Authorization: Bearer <token>. When unset, the endpoint remains open (backward-compatible for local development).

Files changed

File	Change
*/server/index.js (×4)	cors() → cors({ origin: appBaseUrl }), auth gate on events endpoint
*/.env.example (×4)	Document optional ADMIN_TOKEN variable

Testing

• Existing frontend demos continue to work (same-origin requests are allowed)
• Cross-origin requests from other origins are now blocked
• Webhook events endpoint requires Authorization: Bearer <token> header when ADMIN_TOKEN is set