feat(pay): httpapi 加 CORS(web 跨域下单)+ 部署到 pangolin1 准备(#34/34A)

withCORS 中间件:仅白名单 origin(默认 pangolin.yanmeiai.com + pages.dev)返回 CORS 头、
OPTIONS 直接 204;New(svc, corsOrigins) + main 读 PAY_CORS_ORIGINS。为官网下单页跨域调 pay 铺路。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pay/internal/httpapi/handler.go

@@ -14,8 +14,9 @@ import (
 
 type Handler struct{ svc *pay.Service }
 
-// New wires the routes (Go 1.22 method+wildcard patterns).
-func New(svc *pay.Service) http.Handler {
+// New wires the routes (Go 1.22 method+wildcard patterns) and applies CORS for
+// the whitelisted browser origins (comma-separated; empty = no CORS headers).
+func New(svc *pay.Service, corsOrigins string) http.Handler {
 	h := &Handler{svc: svc}
 	mux := http.NewServeMux()
 	mux.HandleFunc("POST /order", h.createOrder)
@@ -24,7 +25,7 @@ func New(svc *pay.Service) http.Handler {
 		w.WriteHeader(http.StatusOK)
 		_, _ = w.Write([]byte("ok"))
 	})
-	return mux
+	return withCORS(mux, parseOrigins(corsOrigins))
 }
 
 type createReq struct {