docs(cors): X-API-Version 明确为 advisory 惯例头(E1) — 消除版本协商假象

- middleware: CORS Allow-Headers 加 X-API-Version(跨域客户端不再预检失败)
- api-reference §0.2 + api-client §4.1: 声明服务端不校验、不据此协商版本
- 后端/前端零行为改动(前端仍在发,现CORS放行)

internal/services/gateway/middleware.go

@@ -24,7 +24,7 @@ func (s *Server) cors(next http.Handler) http.Handler {
 			}
 			w.Header().Set("Vary", "Origin")
 			w.Header().Set("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS")
-			w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type")
+			w.Header().Set("Access-Control-Allow-Headers", "Authorization, Content-Type, X-API-Version")
 			w.Header().Set("Access-Control-Expose-Headers", voiceProviderHeader)
 			w.Header().Set("Access-Control-Max-Age", "600")
 		}