fix(cors): allow PATCH in restricted policy

[CattonNyan]

Problem

The shipped restricted CORS configuration allows GET, POST, PUT, and DELETE, but does not allow PATCH.

The API already exposes PATCH endpoints for product prices, product stock, file visibility, and user status, and both React clients call these endpoints. When the frontend and API use different origins with CorsOptions.AllowAll=false, the browser rejects the PATCH preflight before the request reaches the API.

This is hidden during local development because appsettings.Development.json sets AllowAll=true, which uses AllowAnyMethod().

Fix

• Add PATCH to CorsOptions.AllowedMethods in appsettings.json.
• Add PATCH to the production configuration as well.
• Add regression tests verifying that both shipped restricted configurations include PATCH.
• Keep the fix outside the protected src/BuildingBlocks area.

Verification

• dotnet test src/Tests/Framework.Tests/Framework.Tests.csproj -c Release
  • 135 passed, 0 failed
• dotnet build src/FSH.Starter.slnx -c Release --no-restore -warnaserror -p:NuGetAudit=false -m:1
  • 0 warnings, 0 errors
  • NuGet auditing was disabled only to isolate the existing transitive SSH.NET advisory in the integration test projects.

Fixes #1370