docs: clarify CORS header behavior

[vibhor-aggr]

Closes #384.

This keeps the README focused on what the middleware actually does: sets CORS response headers that browsers enforce. It replaces remaining wording that implied server-side request blocking, especially around the origin option, with explicit descriptions of the Access-Control-Allow-Origin value sent in the response.

Verification:

• npm test
• git diff --check