Fix CORS Errors on Next.js

Next.js API routes and Route Handlers need explicit CORS when a SPA on another origin calls them. Use headers() in next.config.js or return CORS headers inside handlers for dynamic Origin checks.

App Router edge functions can short-circuit OPTIONS with 204. Keep credentials flows strict: reflected origins must be validated.

Headers for static assets live in the same config—see Vercel headers.