Stop allowing cross-origin requests (closes #261)

The CORS middleware let every origin make credentialed requests, so a
page on another subdomain of the server's domain could read and act as
the signed-in user. Nothing needs cross-origin access, so the
middleware and the go-chi/cors dependency go. A test checks that a
request from another origin and a preflight get no
Access-Control-Allow-* headers.

Model: opus-5-5

README.md

@@ -168,8 +168,8 @@ either.
 - Request bodies for `POST /api/v1/session`, `POST /api/v1/login` and
   `POST /api/v1/messages` are limited to `MAX_MESSAGE_SIZE` bytes (default
   `4096`). A larger body gets `400` `invalid request body`.
-- The server allows cross-origin requests from any origin, with credentials. The
-  cookie is `SameSite=Strict`, so a browser sends it only from the same site.
+- The server allows no cross-origin requests. In a browser, only pages the
+  server itself serves, such as the web client, can use the API.
 
 ### The auth cookie
 
@@ -1892,14 +1892,13 @@ The IRC listener has no TLS.
   seconds. A request still running after 60 seconds is cancelled, and the
   connection closes without a response. Headers may be up to 1 MiB.
 - A long poll waits at most 30 seconds.
-- Every response to a well-formed request, except to a cross-origin preflight,
-  carries a `Content-Security-Policy` header:
+- Every response to a well-formed request carries a `Content-Security-Policy`
+  header:
   `default-src 'self'; script-src 'self'; style-src 'self'; connect-src 'self'; img-src 'self'; font-src 'self'; object-src 'none'; frame-ancestors 'none'; base-uri 'self'; form-action 'self'`.
   The web client works within it.
-- Cross-origin requests are allowed from any origin, with credentials. The
-  allowed methods are `GET`, `POST`, `PUT`, `DELETE` and `OPTIONS`. The allowed
-  request headers are `Accept`, `Content-Type` and `X-CSRF-Token`. The cookie's
-  `SameSite=Strict` still keeps it to the same site.
+- The server allows no cross-origin requests. No response carries an
+  `Access-Control-Allow-*` header. A preflight request gets `405`, like any
+  other `OPTIONS` request.
 
 ### Logging
 
@@ -2002,8 +2001,8 @@ and their sessions to end. Then it closes the database.
   gets a message.
 - `internal/hashcash/`: stamp checking and minting.
 - `internal/ratelimit/`: the per-address login rate limiter.
-- `internal/middleware/`: finding the client's address, request logging,
-  cross-origin requests, the `Content-Security-Policy` header and metrics.
+- `internal/middleware/`: finding the client's address, request logging, the
+  `Content-Security-Policy` header and metrics.
 - `internal/healthcheck/` and `internal/stats/`: the health check and its
   counters.
 - `internal/logger/` and `internal/globals/`: logging setup and build