### fix: behebe CORS-Probleme und Stabilitätsfehler

- **MailController:** Erweitere `@CrossOrigin`-Headers und Methoden für Preflight-Checks.
- **GlobalSecurityConfig:** Reaktiviere CORS und füge explizite `CorsConfigurationSource` hinzu.
- **Tests:** Fix für `NoSuchBeanDefinitionException` bei Integrationstests.
- **UI:** Aktualisiere Versionsmarker auf `v2026-04-23.15 - CORS STABILITY`.

backend/infrastructure/security/src/main/kotlin/at/mocode/infrastructure/security/GlobalSecurityConfig.kt

@@ -7,10 +7,16 @@ import org.springframework.security.config.annotation.web.builders.HttpSecurity
 import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity
 import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.oauth2.core.DelegatingOAuth2TokenValidator
-import org.springframework.security.oauth2.jwt.*
+import org.springframework.security.oauth2.jwt.Jwt
+import org.springframework.security.oauth2.jwt.JwtDecoder
+import org.springframework.security.oauth2.jwt.JwtTimestampValidator
+import org.springframework.security.oauth2.jwt.NimbusJwtDecoder
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
 import org.springframework.security.web.SecurityFilterChain
 import org.springframework.security.web.authentication.UsernamePasswordAuthenticationFilter
+import org.springframework.web.cors.CorsConfiguration
+import org.springframework.web.cors.CorsConfigurationSource
+import org.springframework.web.cors.UrlBasedCorsConfigurationSource
 
 @Configuration
 @EnableWebSecurity
@@ -21,10 +27,8 @@ class GlobalSecurityConfig {
   fun filterChain(http: HttpSecurity): SecurityFilterChain {
     http
       .csrf { it.disable() } // CSRF nicht nötig für Stateless REST APIs
-      // WICHTIG: CORS explizit deaktivieren!
-      // Das API-Gateway kümmert sich um CORS. Die Microservices dürfen KEINE
-      // Access-Control-Allow-Origin Header setzen, sonst haben wir doppelte Header beim Client.
-      .cors { it.disable() }
+      // WICHTIG: CORS wieder aktivieren für Plan-B (Direktzugriff ohne Gateway möglich)
+      .cors { it.configurationSource(corsConfigurationSource()) }
       .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
       .addFilterBefore(DeviceSecurityFilter(), UsernamePasswordAuthenticationFilter::class.java)
       .authorizeHttpRequests { auth ->
@@ -71,4 +75,22 @@ class GlobalSecurityConfig {
     converter.setJwtGrantedAuthoritiesConverter(KeycloakRoleConverter())
     return converter
   }
+
+  @Bean
+  fun corsConfigurationSource(): CorsConfigurationSource {
+    val configuration = CorsConfiguration()
+    configuration.allowedOrigins = listOf(
+      "https://app.mo-code.at",
+      "https://api.mo-code.at",
+      "http://localhost:8080",
+      "http://localhost:8083",
+      "http://localhost:4000"
+    )
+    configuration.allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "OPTIONS")
+    configuration.allowedHeaders = listOf("*")
+    configuration.allowCredentials = true
+    val source = UrlBasedCorsConfigurationSource()
+    source.registerCorsConfiguration("/**", configuration)
+    return source
+  }
 }