Integrate cors_policy class to standardize CORS handling, refactor optionsRoute to use it, and add unit tests for CORS and Self-Serve Lane Access functionalities.

openapi.yaml

@@ -8957,6 +8957,10 @@ paths:
       description: |
         Send a command (e.g., start, stop, reset) to a self-serve lane.
         Property gate commands (`OPEN_PROPERTY_ACCESS_GATE`, `OPEN_PROPERTY_EXIT_GATE`) are also supported here.
+        Operator callers require the base command permission plus the command-specific permission. Authenticated
+        customers with `list_own_department_selfserve_vehicle_conditions` may send `START` on enabled self-serve
+        lanes. Customer `STOP` and property gate commands require the customer's active self-serve wash in the target
+        department.
       operationId: sendSelfServeLaneCommand
       requestBody:
         required: true
@@ -9007,6 +9011,9 @@ paths:
         Updates the set of services that are allowed to be manually activated for a given self-serve lane,
         derived from the tasks currently shown to the user after answering the self-serve questions.
         This endpoint does not activate anything by itself; it only sets what is allowed to be activated.
+        Operator callers require `modules_selfserve_lane_services_set_allowed`; authenticated customers with
+        `list_own_department_selfserve_vehicle_conditions` may update their enabled self-serve lane before
+        confirming a wash start.
       operationId: setSelfServeLaneAllowedServices
       requestBody:
         required: true
@@ -9450,7 +9457,9 @@ paths:
       description: |
         Manually turns on the MACHINE relay for a self-serve lane if and only if the current allowed services
         include `MACHINE` (set via `/modules/self-serve/lane/services/allowed`). The relay is never automatically
-        enabled; an explicit call to this endpoint is required.
+        enabled; an explicit call to this endpoint is required. Operator callers require
+        `modules_selfserve_lane_relay_enable_machine`; authenticated customers with
+        `list_own_department_selfserve_vehicle_conditions` may enable it only for their active self-serve wash.
         Transport follows the department `shelly_transport_mode`; `transport=local` or `transport=gateway`
         forces local-only diagnostics, and `transport=cloud` forces Shelly cloud.
       operationId: enableSelfServeLaneMachineRelay