fix: KGEmptyError 自定义异常 + CORS 环境变量配置

- qa_service 定义 KGEmptyError 异常，run_query 抛出；routers/query 精确捕获 → HTTP 400 + code 3002，移除字符串匹配
- main.py CORS 改为读 CORS_ORIGINS 环境变量：未设置时 wildcard + credentials=False（合规默认），设置后显式列表 + credentials=True
- .env.example 新增 CORS_ORIGINS 默认值（后端 + 前端 4 个域名）

backend/main.py

@@ -2,6 +2,7 @@
 GraphRAG Studio — FastAPI Backend
 Entry point: uvicorn main:app --host 0.0.0.0 --port 8000 --reload
 """
+import os
 import sys
 from pathlib import Path
 
@@ -25,10 +26,22 @@ app = FastAPI(
     redoc_url="/redoc",
 )
 
+# CORS — explicit origins when set, wildcard otherwise.
+# Auth uses Bearer headers (not cookies), so credentials are only needed when
+# the browser is also sending cookies; keep credentials=False with wildcard to
+# avoid the CORS spec rejecting the combo at runtime.
+_cors_origins_raw = os.getenv("CORS_ORIGINS", "").strip()
+if _cors_origins_raw:
+    _cors_origins = [o.strip() for o in _cors_origins_raw.split(",") if o.strip()]
+    _cors_credentials = True
+else:
+    _cors_origins = ["*"]
+    _cors_credentials = False
+
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=True,
+    allow_origins=_cors_origins,
+    allow_credentials=_cors_credentials,
     allow_methods=["*"],
     allow_headers=["*"],
 )