Browser-based frontends need CORS to call the API. Apply tower_http::cors::CorsLayer::permissive() at the router level so the frontend (and other origins during development) can reach the scan endpoint.