spatialvault

fix: use anyhow for error chain display instead of hand-rolled helper

fix: mount router under path prefix derived from base_url

feat: support opaque token via OIDC token introspection

fix: restrict CORS to explicit headers and methods

fix: tests