Allow Openvine Pages previews in auth CORS

[rabble]

Summary

• allow restricted auth CORS origins to match wildcard subdomains such as https://*.openvine-app.pages.dev
• deploy the preview-domain pattern in Cloud Run and assert the returned Access-Control-Allow-Origin header in smoke tests
• document wildcard CORS origin support in env and deployment examples

Test Plan

• cargo fmt --all
• cargo test -p keycast origin_is_allowed
• cargo test -p keycast test_origin_is_not_allowed_for_non_matching_wildcard_host
• cargo test -p keycast