Fix CORS config: use str type to avoid pydantic-settings JSON parsing; fallback gracefully for env var format issues

Upload folder using huggingface_hub