fix: use JSON array format for CORS_ORIGINS env var

Pydantic settings expects list[str] fields as JSON arrays, not plain strings.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

stacks/tatlock.yml

@@ -34,7 +34,7 @@ services:
       - REDIS_TIMEOUT=5
       # Features
       - ENABLE_BENCHMARKS=true
-      - CORS_ORIGINS=*
+      - CORS_ORIGINS=["*"]
       - PYTHONPATH=/app
 
     volumes: