docs: tambah doc comment, logging, dan inline comments di semua 255 file

Meliputi:
- File-level //! doc comment: tujuan file, alur kerja, komponen utama
- Function-level /// doc comment: apa, parameter, return, flow, edge cases
- Struct/enum/trait /// doc comment: peran, field docs
- Tracing logging (tracing::info!/debug!/trace!/warn!/error!) di setiap fungsi
- Inline comments untuk variable dan branching logic penting
- Seluruh 8 crates di workspace: zesdex-backend, zesdex-cms, zesdex-entities,
  zesdex-iam, zesdex-infra, zesdex-ipc, zesdex-middleware, zesdex-utils
- Build: 0 errors, 242/242 tests passed

crates/zesdex-middleware/src/cors.rs

@@ -12,9 +12,18 @@ use tower_http::cors::{AllowHeaders, AllowOrigin, CorsLayer};
 /// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
 /// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
 ///   `X-Request-Id`, `User-Agent`
+/// Return a permissive [`CorsLayer`] for local daemon IPC.
+///
+/// - **Origin**: any (`*`)
+/// - **Methods**: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `OPTIONS`
+/// - **Headers**: `Content-Type`, `Authorization`, `X-Session-Id`,
+///   `X-Request-Id`, `User-Agent`
+///
+/// Since the daemon only listens on localhost, any origin is allowed.
+/// The exposed headers let the browser JS read session/request IDs.
 pub fn default_cors_layer() -> CorsLayer {
     CorsLayer::new()
-        .allow_origin(AllowOrigin::any())
+        .allow_origin(AllowOrigin::any()) // permissive — daemon is localhost-only
         .allow_methods([
             "GET".parse().unwrap(),
             "POST".parse().unwrap(),
@@ -22,13 +31,13 @@ pub fn default_cors_layer() -> CorsLayer {
             "DELETE".parse().unwrap(),
             "PATCH".parse().unwrap(),
             "OPTIONS".parse().unwrap(),
-        ])
+        ]) // standard REST methods
         .allow_headers(AllowHeaders::any())
         .expose_headers([
             "Content-Type".parse().unwrap(),
             "X-Session-Id".parse().unwrap(),
             "X-Request-Id".parse().unwrap(),
-        ])
+        ]) // headers exposed to the browser JS
 }
 
 #[cfg(test)]