[elfkuzco]

Rationale

This PR enhances the API to allow public and unauthenticated GET/HEAD endpoints to be read from any origin while keeping endpoints behind a permission or state-changing routes behind the standard CORS policy

Changes

• add custom middleware to set relaxed CORS policy for public read-only endpoints
• add decorator (@cors_public) to explicitly mark endpoints as public and read-only
• update integrators README with section on CORS policy

This closes #611

[codecov]

Codecov Report

❌ Patch coverage is 96.66667% with 3 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.65%. Comparing base (9d6ec0b) to head (53c3cd7).

Files with missing lines	Patch %	Lines
backend/src/cms_backend/api/main.py	77.77%	1 Missing and 1 partial ⚠️
backend/src/cms_backend/api/middleware/cors.py	97.95%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #630      +/-   ##
==========================================
+ Coverage   81.41%   81.65%   +0.24%     
==========================================
  Files          85       86       +1     
  Lines        6048     6134      +86     
  Branches      771      780       +9     
==========================================
+ Hits         4924     5009      +85     
  Misses        892      892              
- Partials      232      233       +1     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[benoit74]

One minor point, I let you decide and then you can merge on your own.