feat(TRUEREF-0009-0010): implement indexing pipeline job queue and public REST API

- SQLite-backed job queue with sequential processing and startup recovery
- Atomic snippet replacement in single transaction
- context7-compatible GET /api/v1/libs/search and GET /api/v1/context
- Token budget limiting and JSON/txt response format support
- CORS headers on all API routes via SvelteKit handle hook
- Library ID parser supporting /owner/repo and /owner/repo/version

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/hooks.server.ts

@@ -64,9 +64,38 @@ try {
 }
 
 // ---------------------------------------------------------------------------
-// Request handler (pass-through)
+// CORS headers applied to all /api/* responses
+// ---------------------------------------------------------------------------
+
+const CORS_HEADERS = {
+	'Access-Control-Allow-Origin': '*',
+	'Access-Control-Allow-Methods': 'GET, POST, PATCH, DELETE, OPTIONS',
+	'Access-Control-Allow-Headers': 'Content-Type, Authorization'
+} as const;
+
+// ---------------------------------------------------------------------------
+// Request handler — CORS + pass-through
 // ---------------------------------------------------------------------------
 
 export const handle: Handle = async ({ event, resolve }) => {
-	return resolve(event);
+	const { pathname } = event.url;
+
+	// Handle CORS pre-flight for all API routes.
+	if (event.request.method === 'OPTIONS' && pathname.startsWith('/api/')) {
+		return new Response(null, {
+			status: 204,
+			headers: CORS_HEADERS
+		});
+	}
+
+	const response = await resolve(event);
+
+	// Attach CORS headers to all API responses.
+	if (pathname.startsWith('/api/')) {
+		for (const [key, value] of Object.entries(CORS_HEADERS)) {
+			response.headers.set(key, value);
+		}
+	}
+
+	return response;
 };