feat(pay): httpapi 加 CORS(web 跨域下单)+ 部署到 pangolin1 准备(#34/34A)

withCORS 中间件:仅白名单 origin(默认 pangolin.yanmeiai.com + pages.dev)返回 CORS 头、
OPTIONS 直接 204;New(svc, corsOrigins) + main 读 PAY_CORS_ORIGINS。为官网下单页跨域调 pay 铺路。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pay/cmd/paywatch/main.go

@@ -114,7 +114,7 @@ func main() {
 	defer stop()
 	go w.Loop(ctx, time.Duration(pollSec)*time.Second)
 
-	srv := &http.Server{Addr: addr, Handler: httpapi.New(svc), ReadHeaderTimeout: 10 * time.Second}
+	srv := &http.Server{Addr: addr, Handler: httpapi.New(svc, env("PAY_CORS_ORIGINS", "https://pangolin.yanmeiai.com,https://pangolin-site.pages.dev")), ReadHeaderTimeout: 10 * time.Second}
 	go func() {
 		log.Info("pangolin-pay listening", "addr", addr, "poll_seconds", pollSec)
 		if err := srv.ListenAndServe(); err != nil && err != http.ErrServerClosed {