feat(Backend): update API gateway and websocket hubs

FinlyticBackend/Util/AllowOptionsFilter.cs

@@ -0,0 +1,22 @@
+using Microsoft.AspNetCore.Mvc.Filters;
+
+namespace FinlyticBackend.Util;
+
+/// <summary>
+/// A global authorization filter that short-circuits authorization checks for HTTP OPTIONS requests.
+/// This is required for CORS preflight to succeed on endpoints protected with [Authorize]:
+/// the browser sends a parameter-less OPTIONS request before the real request, and any 401
+/// response on that preflight causes the actual request to be blocked with a CORS error.
+/// </summary>
+public class AllowOptionsFilter : IAuthorizationFilter
+{
+    public void OnAuthorization(AuthorizationFilterContext context)
+    {
+        if (context.HttpContext.Request.Method == HttpMethods.Options)
+        {
+            // Return 204 No Content immediately — the manual CORS middleware in Program.cs
+            // has already written the Access-Control-Allow-* headers.
+            context.Result = new Microsoft.AspNetCore.Mvc.StatusCodeResult(204);
+        }
+    }
+}