fix(console): add cors to zen responses

[zcxGGmu]

Issue for this PR

Closes #41224

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

Adds CORS headers to actual Zen model-list responses, not only OPTIONS preflight responses. The shared helper is also used by the main Zen chat handler response headers so normal GET/POST responses include Access-Control-Allow-Origin as browsers require after a successful preflight.

This keeps the existing permissive preflight policy (*, GET, POST, OPTIONS, Content-Type, Authorization) and applies it to actual API responses.

How did you verify your code works?

• cd packages/console/app && bun test test/zenCors.test.ts --timeout 30000
• cd packages/console/app && bun run typecheck
• bunx oxlint packages/console/app/src/routes/zen/util/modelsHandler.ts packages/console/app/src/routes/zen/util/handler.ts packages/console/app/test/zenCors.test.ts
• git diff --check

Screenshots / recordings

N/A; this is a response-header fix.

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

[github-actions]

The following comment was made by an LLM, it may be inaccurate:

Potential Duplicate Found

PR #37932: fix(console): add CORS headers and OPTIONS preflight to Zen/Go API endpoints
#37932

Why it might be related:

• Both PRs address CORS headers for Zen API endpoints
• Both deal with Access-Control-Allow-Origin headers and preflight handling
• The older PR (fix(console): add CORS headers and OPTIONS preflight to Zen/Go API endpoints #37932) appears to be a previous attempt to add CORS support to the same Zen endpoints

You should verify if #37932 is already merged or if it addresses the same issue (#41224). If it's closed/merged without fixing the issue, that explains why the current PR was needed.

[github-actions]

Automated PR Cleanup

Thank you for contributing to opencode.

Due to the high volume of PRs from users and AI agents, we periodically close older PRs using automated criteria so maintainers can focus review time on the most active and community-supported contributions.

This PR was closed because it matched the following cleanup criteria:

• The PR was created more than 1 month ago
• The PR had fewer than 2 positive reactions
• Positive reactions are counted as thumbs-up, heart, celebration, or rocket reactions on the PR

PRs created within the last month are not affected by this cleanup.

If you believe this PR was closed incorrectly, or if you are still actively working on it, please leave a comment explaining why it should be reopened. A maintainer can review and reopen it if appropriate.

Thanks again for taking the time to contribute.