fix: only register debug endpoint when DEBUG=True

The /debug/cors endpoint is now conditionally registered, preventing
information leakage about CORS configuration in production.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/app/main.py

@@ -89,8 +89,9 @@ async def health_check():
     return {"status": "healthy"}
 
 
-@app.get("/debug/cors")
+if settings.DEBUG:
-async def debug_cors():
+    @app.get("/debug/cors")
+    async def debug_cors():
         """Debug endpoint to check CORS configuration."""
         return {
             "allow_railway_origins": settings.ALLOW_RAILWAY_ORIGINS,