FastAPI backend says CORS error only from my Windsurf frontend

* and credentials do not mix: browsers refuse Access-Control-Allow-Origin: * when credentials: 'include' is set. List the origin explicitly:

app.add_middleware(CORSMiddleware,
    allow_origins=["https://app.example.com", "http://localhost:5173"],
    allow_credentials=True,
    allow_methods=["*"], allow_headers=["*"])

Postman never does CORS, which is why it "works" there.