fix(api): add credentials header to cors error responses

The errorHandler middleware was missing the `Access-Control-Allow-Credentials`
header in its CORS configuration. This caused browsers to block credentialed
requests (e.g., those with an Authorization header) that resulted in an
error, leading to a specific CORS failure.

This change adds the `Access-Control-Allow-Credentials: true` header to
all error responses when the origin is allowed, resolving the issue and
allowing the client to correctly read API error messages for authenticated
or credentialed requests.

Author: fulleni

lib/src/middlewares/error_handler.dart

@@ -127,6 +127,7 @@ Response _jsonErrorResponse({
 
     if (isOriginAllowed) {
       headers[HttpHeaders.accessControlAllowOriginHeader] = requestOrigin;
+      headers[HttpHeaders.accessControlAllowCredentialsHeader] = 'true';
       headers[HttpHeaders.accessControlAllowMethodsHeader] =
           'GET, POST, PUT, DELETE, OPTIONS';
       headers[HttpHeaders.accessControlAllowHeadersHeader] =