feat(pay): httpapi 加 CORS(web 跨域下单)+ 部署到 pangolin1 准备(#34/34A)

withCORS 中间件:仅白名单 origin(默认 pangolin.yanmeiai.com + pages.dev)返回 CORS 头、
OPTIONS 直接 204;New(svc, corsOrigins) + main 读 PAY_CORS_ORIGINS。为官网下单页跨域调 pay 铺路。

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

pay/internal/httpapi/handler_test.go

@@ -16,7 +16,7 @@ const recvAddr = "TRecv00000000000000000000000000000A"
 func TestCreateGetAndConflict(t *testing.T) {
 	st, _ := store.Open(":memory:")
 	t.Cleanup(func() { _ = st.Close() })
-	srv := httptest.NewServer(New(pay.New(st, pay.Config{ReceiveAddress: recvAddr})))
+	srv := httptest.NewServer(New(pay.New(st, pay.Config{ReceiveAddress: recvAddr}), "https://pangolin.yanmeiai.com"))
 	t.Cleanup(srv.Close)
 
 	body, _ := json.Marshal(map[string]any{"user_ref": "u1", "sku": "pro-year", "amount": 5_000000})