feat(api): add permissive CORS layer

Browser-based frontends need CORS to call the API. Apply
tower_http::cors::CorsLayer::permissive() at the router level so
the frontend (and other origins during development) can reach the
scan endpoint.

api/Cargo.toml

@@ -19,6 +19,7 @@ stealth-bitcoincore = { path = "../bitcoincore" }
 stealth-engine = { workspace = true }
 thiserror = { workspace = true }
 tokio = { workspace = true }
+tower-http = { version = "0.6.6", features = ["cors"] }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }