feature: CORS headers and cleanup

src/handle_resolver/base.rs

···
         let did = resolve_subject(&self.http_client, &*self.dns_resolver, s)
             .await
             .map_err(|e| HandleResolverError::ResolutionFailed(e.to_string()))?;
-        
+
         let timestamp = SystemTime::now()
             .duration_since(UNIX_EPOCH)
-            .map_err(|e| HandleResolverError::ResolutionFailed(format!("System time error: {}", e)))?
+            .map_err(|e| {
+                HandleResolverError::ResolutionFailed(format!("System time error: {}", e))
+            })?
             .as_secs();
-        
+
         Ok((did, timestamp))
     }
 }

src/http/handle_xrpc_resolve_handle.rs

···
         }
     };
 
-    // Add Cache-Control header if configured
-    if let Some(cache_control) = app_context.cache_control_header() {
-        if let Ok(cache_control_value) = HeaderValue::from_str(cache_control) {
-            response
-                .headers_mut()
-                .insert(header::CACHE_CONTROL, cache_control_value);
-        }
-    }
+    let headers = response.headers_mut();
 
     // Add ETag header
     match HeaderValue::from_str(&etag) {
         Ok(etag_header_value) => {
-            response
-                .headers_mut()
-                .insert(header::ETAG, etag_header_value);
+            headers.insert(header::ETAG, etag_header_value);
         }
         Err(err) => {
             tracing::error!(error = ?err, "unable to create etag response value");
         }
     }
+
+    // Add Cache-Control header if configured
+    if let Some(cache_control) = app_context.cache_control_header()
+        && let Ok(cache_control_value) = HeaderValue::from_str(cache_control)
+    {
+        headers.insert(header::CACHE_CONTROL, cache_control_value);
+    }
+
+    // Add CORS and Allow headers
+    headers.insert("Allow", HeaderValue::from_static("GET, HEAD, OPTIONS"));
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_HEADERS,
+        HeaderValue::from_static("*"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_METHODS,
+        HeaderValue::from_static("GET, HEAD, OPTIONS"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_ALLOW_ORIGIN,
+        HeaderValue::from_static("*"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_EXPOSE_HEADERS,
+        HeaderValue::from_static("*"),
+    );
+    headers.insert(
+        header::ACCESS_CONTROL_MAX_AGE,
+        HeaderValue::from_static("86400"),
+    );
+    headers.insert(
+        "Access-Control-Request-Headers",
+        HeaderValue::from_static("*"),
+    );
+    headers.insert(
+        "Access-Control-Request-Method",
+        HeaderValue::from_static("GET"),
+    );
 
     Ok(response)
 }