feat: add web form designer

backend/boot/src/main/kotlin/com/all8ai/aioa/shared/security/SecurityConfiguration.kt

@@ -5,16 +5,31 @@ import org.springframework.context.annotation.Configuration
 import org.springframework.security.config.Customizer.withDefaults
 import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.web.SecurityFilterChain
+import org.springframework.web.cors.CorsConfiguration
+import org.springframework.web.cors.CorsConfigurationSource
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource
 
 @Configuration
 class SecurityConfiguration {
     @Bean
     fun securityFilterChain(http: HttpSecurity): SecurityFilterChain = http
         .csrf { it.disable() }
+        .cors(withDefaults())
         .authorizeHttpRequests {
             it.requestMatchers("/actuator/health", "/actuator/info").permitAll()
                 .anyRequest().authenticated()
         }
         .oauth2ResourceServer { it.jwt(withDefaults()) }
         .build()
+
+    @Bean
+    fun corsConfigurationSource(): CorsConfigurationSource = UrlBasedCorsConfigurationSource().apply {
+        registerCorsConfiguration("/api/**", CorsConfiguration().apply {
+            allowedOrigins = listOf("http://localhost:5173", "http://127.0.0.1:5173")
+            allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "OPTIONS")
+            allowedHeaders = listOf("Authorization", "Content-Type", "X-AIOA-Device-Id", "Idempotency-Key", "X-Trace-Id")
+            exposedHeaders = listOf("X-Trace-Id", "X-AIOA-Auth-Error")
+            allowCredentials = true
+        })
+    }
 }