Add NoDecode annotation to cors_origins field in Settings to properly parse comma-separated values from environment variables. Add test to verify CORS_ORIGINS accepts comma-separated list.
Bump FastAPI to 0.136.3, uvicorn to 0.49.0, python-jose to 3.5.0, python-multipart to 0.27, cryptography to 46.0.7, bandit to 1.9.4, and pip-audit to 2.10.0. Add explicit dependencies for starlette, ecdsa, idna, pyasn1, python-dotenv, mako, and PyJWT.