fix: set allow_credentials=False to fix CORS with wildcard origin

allow_credentials=True + allow_origins=["*"] is invalid per the CORS spec.
Starlette drops the Access-Control-Allow-Origin header in this case.
The API uses no cookies so credentials are not needed.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/main.py

@@ -31,7 +31,7 @@ else:
 app.add_middleware(
     CORSMiddleware,
     allow_origins=allow_origins,
-    allow_credentials=True,
+    allow_credentials=False,
     allow_methods=["*"],
     allow_headers=["*"],
 )