fix: add CORS headers for OAuth and MCP endpoints

Required for claude.ai browser-based OAuth flows that make
cross-origin requests to discovery, token, and MCP endpoints.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/server/index.ts

@@ -1,5 +1,6 @@
 import { Hono } from "hono";
 import { serveStatic } from "hono/bun";
+import { cors } from "hono/cors";
 import { db as prodDb } from "../db/index.ts";
 import { seedDefaults } from "../db/seed.ts";
 import { mcpRoutes } from "./mcp/index.ts";
@@ -34,6 +35,11 @@ app.get("/api/health", (c) => {
 	return c.json({ status: "ok" });
 });
 
+// CORS for OAuth and MCP endpoints (required for claude.ai browser-based flows)
+app.use("/.well-known/*", cors());
+app.use("/oauth/*", cors());
+app.use("/mcp/*", cors());
+
 // OAuth routes (must be before /api/* middleware)
 app.use("/oauth/*", async (c, next) => {
 	c.set("db", prodDb);