Add full CORS (Cross-Origin Resource Sharing) per the Fetch Standard: - Simple request detection: CORS-safelisted methods (GET/HEAD/POST) and headers (Accept, Accept-Language, Content-Language, Content-Type with safelisted values) skip preflight - Preflight (OPTIONS) requests for non-simple cross-origin requests with Access-Control-Request-Method/Headers, validated against server response - Preflight cache keyed by (origin, URL) with Access-Control-Max-Age TTL - Access-Control-Allow-Origin validation (wildcard and exact match) - Access-Control-Allow-Credentials enforcement (must be exact origin echo and 'true' when credentials: include) - Access-Control-Expose-Headers controls which response headers scripts see - Response header filtering (only CORS-safelisted + explicitly exposed) - Origin header sent on all cross-origin requests - Fetch API supports mode (cors/no-cors) and credentials (omit/same-origin/ include) options Integration points: - crates/net/src/cors.rs: core CORS module (56 unit tests) - crates/browser/src/loader.rs: CORS in resource loading pipeline - crates/js/src/fetch.rs: CORS mode/credentials in Fetch API bridge Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>