feat: CORS, role in auth, banner_url, diary sort, cleanup

- CORS layer on API routes via CORS_ORIGINS env var
- role field in login + profile responses
- banner_url in profile response
- diary sort_by: rating_desc/rating_asc/date_asc/date_desc
- UserRole::as_str() to deduplicate role mapping
- typed DTOs for import preview (replace ad-hoc JSON)
- warn on invalid CORS origins

crates/presentation/Cargo.toml

@@ -24,7 +24,7 @@ postgres-federation = [
 ]
 
 [dependencies]
-tower-http = { version = "0.6.8", features = ["fs", "trace", "tracing"] }
+tower-http = { version = "0.6.8", features = ["cors", "fs", "trace", "tracing"] }
 infer = "0.19.0"
 percent-encoding = "2"
 axum-governor = "2"