fix(cfc-backend): CORS - add PrivateNetwork header + explicit allowedOrigins

- Add Access-Control-Allow-Private-Network: true filter (Chrome PNA policy)
- Replace allowedOriginPatterns("*") with explicit origins (CORS spec: "*" + allowCredentials invalid)
- Allowed: https://cfc.etotem.com.cn, http://cfc.etotem.com.cn, localhost/127.0.0.1 dev origins

cfc-backend/src/main/java/com/etotem/cfc/config/WebConfig.java

@@ -1,12 +1,19 @@
 package com.etotem.cfc.config;
 
 import javax.annotation.Resource;
+import org.springframework.context.annotation.Bean;
 import org.springframework.context.annotation.Configuration;
+import org.springframework.core.Ordered;
+import org.springframework.core.annotation.Order;
 import org.springframework.web.servlet.config.annotation.CorsRegistry;
 import org.springframework.web.servlet.config.annotation.InterceptorRegistry;
 import org.springframework.web.servlet.config.annotation.ResourceHandlerRegistry;
 import org.springframework.web.servlet.config.annotation.WebMvcConfigurer;
 
+import javax.servlet.*;
+import javax.servlet.http.HttpServletResponse;
+import java.io.IOException;
+
 @Configuration
 public class WebConfig implements WebMvcConfigurer {
 
@@ -19,13 +26,28 @@ public class WebConfig implements WebMvcConfigurer {
     @Override
     public void addCorsMappings(CorsRegistry registry) {
         registry.addMapping("/**")
-                .allowedOriginPatterns("*")
+                .allowedOriginPatterns("https://cfc.etotem.com.cn", "http://cfc.etotem.com.cn", "http://localhost:*", "http://127.0.0.1:*")
                 .allowedMethods("GET", "POST", "PUT", "DELETE", "OPTIONS")
                 .allowedHeaders("*")
                 .allowCredentials(true)
                 .maxAge(3600);
     }
 
+    /** Chrome Private Network Access: allow requests from non-secure contexts to private-network backend */
+    @Bean
+    @Order(Ordered.HIGHEST_PRECEDENCE)
+    public Filter privateNetworkAccessFilter() {
+        return new Filter() {
+            @Override
+            public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain)
+                    throws IOException, ServletException {
+                HttpServletResponse resp = (HttpServletResponse) response;
+                resp.setHeader("Access-Control-Allow-Private-Network", "true");
+                chain.doFilter(request, response);
+            }
+        };
+    }
+
     @Override
     public void addInterceptors(InterceptorRegistry registry) {
         registry.addInterceptor(jwtInterceptor)