security: CORS preflight, session invalidation, CSRF on preview, symlink containment, and hardening

- Add OPTIONS /api/volumen/* for CORS preflight (S-22).
- Invalidate session in require_login! when user no longer exists (S-8).
- Add check_csrf! to POST /admin/preview (S-1).
- Use File.realpath for symlink-safe containment in media_file (S-2).
- Memoize Users#all with mtime-based invalidation (S-12).
- Document that empty permitted_hosts means allow-all (S-5).
- Warn and fall back to random when session_key is too short (S-20).

test/server_test.rb

@@ -119,4 +119,11 @@ class ServerTest < Minitest::Test
     assert_includes body, "<loc>https://example.com/hello</loc>"
     refute_includes body, "draft"
   end
+
+  def test_cors_preflight
+    options "/api/volumen/site"
+    assert_predicate last_response, :ok?
+    assert_equal "*", last_response.headers["Access-Control-Allow-Origin"]
+    assert_equal "GET, OPTIONS", last_response.headers["Access-Control-Allow-Methods"]
+  end
 end