CORS proxy for OEREB documents / images / XML

Server-side proxy for OEREB legal-provision documents, images and XML extracts hosted on cantonal/federal servers that do not send an Access-Control-Allow-Origin header (so a browser cannot fetch them directly). Fetches the target server-side and streams the bytes back binary-safe, preserving the upstream Content-Type and Content-Disposition, with permissive CORS. The target host must match an allowlist of official OEREB/cantonal/federal domains, so it cannot be used as an open relay. No token required. Replaces the discontinued public corsproxy.io / allorigins.win relays.