Closing as already implemented. SPARC/config.py reads CORS_ORIGINS from the environment (comma-separated list) and api.py passes config.cors_origins to the CORS middleware. Documented in…
Closing as already implemented. SPARC/auth.py contains _check_jwt_secret() which rejects the default JWT secret when APP_ENV is not development. The .env.example documents this behavior.
Triaged by @repo-manager. P2, delegating to @developer. Straightforward template extraction from settings.go into internal/templates/settings.html.
Triaged by @repo-manager. P2, delegating to @qa-engineer. Follow existing httptest.NewServer pattern in client_test.go. 4 test functions needed.
Triaged by @repo-manager. P1 priority, unblocked. Delegating to @developer for implementation. Clear spec with 3 files to change: middleware/auth.go, cmd/server/main.go, middleware/auth_test.go.