fix: add HuggingFace domains to ALLOWED_ORIGINS

- Add youngtsai-career-app.hf.space to CORS allowed origins
- Add huggingface.co domain for embedded iframe support
- Keep API_ADMIN_KEY as required (should be set in HF Spaces secrets)
- Fix line length for flake8 compliance

Generated with [Claude Code](https://claude.ai/code)
via [Happy](https://happy.engineering)

Co-Authored-By: Claude <noreply@anthropic.com>
Co-Authored-By: Happy <yesreply@happy.engineering>

backend/config.py

@@ -23,7 +23,12 @@ class Settings(BaseSettings):
     # Application
     ENVIRONMENT: str = "development"
     API_ADMIN_KEY: str
-    ALLOWED_ORIGINS: str = "http://localhost:3000,http://localhost:7860"
+    ALLOWED_ORIGINS: str = (
+        "http://localhost:3000,"
+        "http://localhost:7860,"
+        "https://youngtsai-career-app.hf.space,"
+        "https://huggingface.co"
+    )
 
     # Vector Search
     VECTOR_DIMENSIONS: int = 1536