Quick fix: `app.main` allow_origins includes empty string when DEV_ALLOWED_ORIGINS unset

[nwalio]

backend/app/main.py:32:

_dev_origins = _os.environ.get("DEV_ALLOWED_ORIGINS", "").split(",") if _os.environ.get("DEV_ALLOWED_ORIGINS") else []

The expression as written is safe (the outer guard skips the split when the env var is missing/empty), but if a user sets DEV_ALLOWED_ORIGINS="" (empty string after =) the guard returns True (the string is empty → falsy in Python, so actually False) — wait, let me re-read.

_os.environ.get("DEV_ALLOWED_ORIGINS") returns "" when set to empty, which is falsy, so _dev_origins = []. OK, safe.

But: DEV_ALLOWED_ORIGINS="https://example.com," (trailing comma — easy to do in YAML/CI config) yields ["https://example.com", ""]. The empty origin then gets appended into allow_origins (line 46), which the CORSMiddleware treats as "no Origin header" — i.e., it disables credentials checks for that case.

Suggested patch:

_dev_origins = [o.strip() for o in _os.environ.get("DEV_ALLOWED_ORIGINS", "").split(",") if o.strip()]

Two characters of .strip() and a filter, and the edge case goes away.