Fix: CORS AllowHeaders에 X-Requested-With 추가

웹 클라이언트의 fetch 요청에서 X-Requested-With 헤더가
CORS preflight에서 차단되는 문제 수정.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/server/server.go

@@ -33,7 +33,7 @@ func New() *fiber.App {
 	app.Use(middleware.SecurityHeaders)
 	app.Use(cors.New(cors.Config{
 		AllowOrigins:     "https://a301.tolelom.xyz",
-		AllowHeaders:     "Origin, Content-Type, Authorization, Idempotency-Key, X-API-Key",
+		AllowHeaders:     "Origin, Content-Type, Authorization, Idempotency-Key, X-API-Key, X-Requested-With",
 		AllowMethods:     "GET, POST, PUT, PATCH, DELETE",
 		AllowCredentials: true,
 	}))