fix: only register debug endpoint when DEBUG=True

The /debug/cors endpoint is now conditionally registered, preventing
information leakage about CORS configuration in production.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/main.py

@@ -89,6 +89,7 @@ async def health_check():
     return {"status": "healthy"}
 
 
+if settings.DEBUG:
     @app.get("/debug/cors")
     async def debug_cors():
         """Debug endpoint to check CORS configuration."""