CORS wildcard origin breaks with CORSMiddleware when using Tor

[shroominic]

When `cors_origins` contains `""`, FastAPI's `CORSMiddleware` doesn't handle it correctly for Tor .onion origins. The wildcard needs to be converted to `allow_origin_regex="."` while keeping explicit origins in the list.

File: `routstr/core/main.py`