Update CORS configuration to support additional origins and regex for local environment

.env.local

@@ -7,7 +7,8 @@ SECRET_KEY="Usu9Qmg4ppRexR6Xp657MMMHsoOaiV8cPqlY_THWNaPhGT6DN9Xd8UO4zG3kWjwIqW9h
 ALLOWED_HOSTS=*
 HOST=127.0.0.1
 FRONTEND_URL=http://localhost:3000
-CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174
+CORS_ALLOWED_ORIGINS=http://localhost:5173,http://localhost:5174,http://localhost:5179
+CORS_ALLOW_ORIGIN_REGEX=https?://(localhost|127\.0\.0\.1):\d+
  
 # Security
 ENCRYPTION_KEY="1cd1dc2d42afc5606e224df1108162db2d6ca372a45a9b8d278162f6006236d5"

app/__init__.py

@@ -173,9 +173,15 @@ def create_app() -> FastAPI:
             "CORS_ALLOWED_ORIGINS must be set when allow_credentials=True"
         )
 
+    # Vite hops 5173+ when ports are taken. Local regex covers that without listing every port.
+    origin_regex = settings.CORS_ALLOW_ORIGIN_REGEX
+    if settings.APP_ENV == "local" and not origin_regex:
+        origin_regex = r"https?://(localhost|127\.0\.0\.1):\d+"
+
     app.add_middleware(
         CORSMiddleware,
         allow_origins=origins,
+        allow_origin_regex=origin_regex,
         allow_credentials=True,
         allow_methods=["*"],
         allow_headers=["*"],