Hardcode CORS credentials disabled and remove env toggle

backend/.env.example

@@ -37,4 +37,3 @@ TYPESENSE_PORT=8108
 TYPESENSE_API_KEY=replace-with-random-typesense-api-key
 TYPESENSE_COLLECTION_NAME=documents
 PUBLIC_BASE_URL=http://localhost:8000
-CORS_ALLOW_CREDENTIALS=false

backend/app/core/config.py

@@ -72,7 +72,6 @@ class Settings(BaseSettings):
     typesense_num_retries: int = 0
     public_base_url: str = "http://localhost:8000"
     cors_origins: list[str] = Field(default_factory=lambda: ["http://localhost:5173", "http://localhost:3000"])
-    cors_allow_credentials: bool = False
 
 
 LOCAL_HOSTNAME_SUFFIXES = (".local", ".internal", ".home.arpa")

backend/app/main.py

@@ -39,7 +39,7 @@ def create_app() -> FastAPI:
     app.add_middleware(
         CORSMiddleware,
         allow_origins=allowed_origins,
-        allow_credentials=bool(getattr(settings, "cors_allow_credentials", False)),
+        allow_credentials=False,
         allow_methods=["*"],
         allow_headers=["*"],
     )