fix: support comma-separated CORS_ORIGINS environment variable

Add NoDecode annotation to cors_origins field in Settings to properly parse comma-separated values from environment variables. Add test to verify CORS_ORIGINS accepts comma-separated list.

backend/app/core/config.py

@@ -1,7 +1,8 @@
 from functools import lru_cache
+from typing import Annotated
 
 from pydantic import field_validator
-from pydantic_settings import BaseSettings, SettingsConfigDict
+from pydantic_settings import BaseSettings, NoDecode, SettingsConfigDict
 
 
 class Settings(BaseSettings):
@@ -13,7 +14,7 @@ class Settings(BaseSettings):
     jwt_secret_key: str
     settings_secret_key: str
     cookie_secure: bool = True
-    cors_origins: list[str] = ["http://localhost"]
+    cors_origins: Annotated[list[str], NoDecode] = ["http://localhost"]
     log_level: str = "INFO"
     default_timezone: str = "Europe/Vienna"
     daily_worker_interval_seconds: int = 300