fix: replace unsupported regex in allow_origins with explicit URLs and allow_origin_regex

[bigeez]

Bug

FastAPI's CORSMiddleware does not support regex patterns in allow_origins
— they are treated as literal strings. Two origins were broken:

• r"^http://localhost:(3000|3001|...)$" — never matched any localhost URL
• r"^https://defi-chat-hub-git-[\w-]+-open-gradient\.vercel\.app$" — never matched Vercel preview URLs

This meant local development environments and Vercel preview deployments
were silently blocked by CORS.

Fix

• Replaced the localhost regex with explicit URLs for each port
• Moved the Vercel pattern to allow_origin_regex which is the correct
  FastAPI parameter that actually supports regex matching

References

FastAPI CORS docs: https://fastapi.tiangolo.com/tutorial/cors/