Fix CORS: allow_credentials must be False for wildcard origins

CORS spec doesn't allow credentials with wildcard origins.
This was causing 403 for all crossorigin module preloads.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

tensors/server/__init__.py

@@ -49,11 +49,11 @@ def create_app() -> FastAPI:
         redoc_url=None,
     )
 
-    # CORS - allow all origins
+    # CORS - allow all origins (credentials=False required for wildcard origin)
     app.add_middleware(
         CORSMiddleware,
         allow_origins=["*"],
-        allow_credentials=True,
+        allow_credentials=False,
         allow_methods=["*"],
         allow_headers=["*"],
     )