[pmanuel1416]

Four independent fixes landing in one commit:

1. CORS middleware env-driven allowlist (Indexer CORS middleware: allowlist origins from env instead of hardcoded wildcard #1289)

   • Rewrite apps/indexer/src/middleware/cors.ts from Hono stubs to real Fastify middleware. Export indexerCorsPlugin (uses @fastify/cors) and a standalone cors() hook for unit tests.
   • resolveAllowedOrigins() reads CORS_ALLOWED_ORIGINS (comma-separated); returns [] for unset/empty/whitespace — fails closed, never falls back to wildcard when an allowlist is configured.
   • cors() echoes the request Origin only when allowlisted; omits Access-Control-Allow-Origin entirely for non-allowlisted/absent origins; sets Vary: Origin; never emits Access-Control-Allow-Origin: *.
   • OPTIONS still returns 204; downstream handlers not invoked on preflight.
   • cors.test.ts rewritten to use Fastify inject() (27 tests).

2. Incident runbook schema drift detection

   • Extend tests/config/incident-runbook.test.ts with brace-counting extractPrismaBlocks() (handles nested {} in @@unique/@@index), parsePrismaSchema() (model→@@Map table names + all enum members), stripSqlLineComments(), extractTableNamesFromSql() (skips pg system tables and SQL keywords), extractEnumLiteralsFromSql() (ALL_CAPS comparison-context literals only, no INSERT VALUES noise).
   • A runbook SQL block referencing an unknown table or enum literal now fails the test with the offending identifier named.
   • Fix pre-existing container name drift: vatix-finalization-job → vatix-finalization-worker in docs/runbooks/incident-runbook.md.
   • All 7 assertions pass (4 existing + 3 new).

3. k6 soak script guards (Add k6 script stub for order placement soak test #807)

   • scripts/load/order-placement-soak.js: throw Error when MARKET_ID is empty, naming the variable and showing the -e MARKET_ID= usage.
   • Emit console.warn when AUTH_HEADER is unset so unauthenticated runs are visible in the summary. Existing ALLOWED_HOSTS guard untouched.

4. Cross-book sweep post-state assertions (Add cross-book sweep fill scenario to matching corpus #808)

   • tests/matching/cross-book-sweep.test.ts: each sweep scenario now asserts trades.length, total filled quantity (sum of trade.quantity), remainingOrder === null, and getDepth() remaining quantities on every maker level of the swept book.
   • Existing toMatchSnapshot() calls and untouched-book assertions preserved.

closes #1396
closes #1397
closes #1398
closes #1399