fix: add CORS headers for static assets — kidlisp.com cross-origin loads
kidlisp.com SPA uses absolute aesthetic.computer URLs for fonts, JS
modules, and other assets. Browsers block these without CORS headers.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>