backend/app.py: CORS policy is too permissive (`*`)