fix(common): harden CORS, sort, raw-SQL WHERE and x-custom-sql-or

Add a `hardening` config section (RESOLVESPEC_HARDENING_*) so each
fix can be switched off to restore the previous behaviour:

- cors_strict_origins: only reflect origins listed in
  cors.allowed_origins / server URLs, with credentials; `*` never
  sends credentials; fix shared-slice append of expose headers.
- sort_strict: join aliases must match `alias.identifier` (empty alias
  no longer matches everything); sort expressions reject dangerous
  functions/catalogs; cql* columns must be identifier-safe.
- sql_strict: client raw-SQL fragments must have balanced parens and
  quotes, no comments/`;`/`$$`, DML keywords, dangerous functions or
  system catalogs; a rejected fragment now fails closed ("(1=0)")
  instead of dropping the filter. Subqueries stay allowed unless
  sql_block_subqueries is set.
- x-custom-sql-or is grouped together with the client's own
  conditions (new optional WhereGrouper, implemented for bun and gorm)
  so it can no longer OR past server-side filters.

pkg/config/manager.go

@@ -168,6 +168,7 @@ func (m *Manager) SetConfig(cfg *Config) error {
 	m.v.Set("event_broker", cfg.EventBroker)
 	m.v.Set("dbmanager", cfg.DBManager)
 	m.v.Set("db_trace", cfg.DBTrace)
+	m.v.Set("hardening", cfg.Hardening)
 	m.v.Set("paths", cfg.Paths)
 	m.v.Set("extensions", cfg.Extensions)
 
@@ -279,6 +280,12 @@ func setDefaults(v *viper.Viper) {
 	v.SetDefault("cors.allowed_headers", []string{"*"})
 	v.SetDefault("cors.max_age", 3600)
 
+	// Security hardening defaults (on)
+	v.SetDefault("hardening.cors_strict_origins", true)
+	v.SetDefault("hardening.sort_strict", true)
+	v.SetDefault("hardening.sql_strict", true)
+	v.SetDefault("hardening.sql_block_subqueries", false)
+
 	// Database defaults
 	v.SetDefault("database.url", "")