feat: CORS, role in auth, banner_url, diary sort, cleanup

- CORS layer on API routes via CORS_ORIGINS env var
- role field in login + profile responses
- banner_url in profile response
- diary sort_by: rating_desc/rating_asc/date_asc/date_desc
- UserRole::as_str() to deduplicate role mapping
- typed DTOs for import preview (replace ad-hoc JSON)
- warn on invalid CORS origins

crates/presentation/src/forms.rs

@@ -251,12 +251,11 @@ pub fn to_diary_query(p: DiaryQueryParams) -> GetDiaryQuery {
     GetDiaryQuery {
         limit: p.limit,
         offset: p.offset,
-        sort_by: p.sort_by.as_deref().map(|s| {
-            if s == "asc" {
-                SortDirection::Ascending
-            } else {
-                SortDirection::Descending
-            }
+        sort_by: p.sort_by.as_deref().map(|s| match s {
+            "date_asc" | "asc" => SortDirection::Ascending,
+            "rating_desc" => SortDirection::ByRatingDesc,
+            "rating_asc" => SortDirection::ByRatingAsc,
+            _ => SortDirection::Descending,
         }),
         movie_id: p.movie_id,
         user_id: None,