Improve CORS config: block all if no origins specified

Refined CORS policy in Program.cs for better security. In development, all origins are allowed. In production, only configured origins are allowed; if none are specified, all cross-origin requests are blocked by default. Switched to Array.Empty<string>() for clarity.

DbFirst.API/Program.cs

@@ -1,6 +1,7 @@
 using DbFirst.API.Middleware;
 using DbFirst.Application;
 using DbFirst.Application.Repositories;
+using DbFirst.Domain;
 using DbFirst.Infrastructure;
 using DbFirst.Infrastructure.Repositories;
 
@@ -26,11 +27,15 @@ builder.Services.AddCors(options =>
         }
         else
         {
-            var origins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? [];
+            var origins = builder.Configuration.GetSection("Cors:AllowedOrigins").Get<string[]>() ?? Array.Empty<string>();
+            if (origins.Length > 0)
+            {
                 policy.WithOrigins(origins)
                       .AllowAnyHeader()
                       .AllowAnyMethod();
             }
+            // if no origins configured, deny all by leaving policy without allowances
+        }
     });
 });