CORS Fix, Log Retention & OS Updates

CORS Origin Fix

• Fixed stale CORS origin — updated to match current application domain

Log Retention Policy (GDPR / HMRC)

• Audit logs: 12-month retention with automatic cleanup
• Authentication tokens: 30-day cleanup for used tokens
• Accounting data: never deleted (7-year HMRC requirement)
• Access logs: extended retention to 90 days
• Application logs: weekly rotation with 12-week retention
• Automated monthly cleanup job

Infrastructure

• OS packages updated to latest stable versions
• Removed unused package repositories