6b1e728700
- Global error handler (app.onError → 500 JSON) - JSON parse validation on POST routes (400) - CORS restricted to localhost origins - 1MB body size limit on POST (413) - CAS store created once per route group, not per-request - 6 new tests covering all changes Closes #120