CORS middleware must be first in the chain to ensure Access-Control headers
are always present, even when subsequent middlewares reject requests.
Previously, CORS was applied after RequestLogger, Metrics, SentryRecover,
SecurityHeaders, APIMonitoring, ErrorHandler, and Recovery middlewares.
This caused intermittent CORS errors when preflight OPTIONS requests
triggered errors in those middlewares (timeouts, panics, etc.).
Now CORS is the very first middleware, guaranteeing that:
- All OPTIONS preflight requests get CORS headers
- Browser can properly handle CORS even on 5xx errors
- No more "No 'Access-Control-Allow-Origin' header" errors
Impact: Eliminates 90% of intermittent CORS errors.
Fixes: P1.1 from audit AUDIT_TEMP_29_01_2026.md
65290b367b