harden telegram webapp production readiness

app/main.py

@@ -3,12 +3,16 @@ from fastapi.middleware.cors import CORSMiddleware
 from fastapi.staticfiles import StaticFiles
 
 from app.api import cars, catalog, entries, ocr, service_centers, users
+from app.core.config import settings
 
 app = FastAPI(title="Drivers Bot API", version="0.1.0")
 
+dev_origins = ["http://localhost:8000", "http://127.0.0.1:8000"] if not settings.is_production else []
+cors_origins = settings.cors_origin_list or dev_origins
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
+    allow_origins=cors_origins,
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],