fix(backend): allow PUT in CORS methods so browser can save settings

Found via live browser test: PUT /settings preflight was rejected because
@fastify/cors default methods omit PUT. GET/POST were unaffected.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/app.ts

@@ -23,7 +23,11 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
   const app = Fastify({ logger: false });
 
   // Allow any origin in dev/e2e; tighten in production via config if needed.
-  app.register(cors, { origin: true, credentials: true });
+  app.register(cors, {
+    origin: true,
+    credentials: true,
+    methods: ["GET", "POST", "PUT", "OPTIONS"],
+  });
 
   const tht = deps?.thtRunner ?? new ThtRunner({
     thtBin: config.thtBin,