Fix CORS for cloud templates routes (#1700)

Fixes OPS-3165

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->
## Summary by CodeRabbit

* **Bug Fixes**
* Adjusted cross-origin handling so CORS headers are applied earlier in
the request lifecycle.
* OPTIONS (preflight) requests now return a 204 response without a
payload, improving compatibility and reducing response overhead.
* Result: more reliable cross-origin requests and slightly improved
request handling performance.

<sub>✏️ Tip: You can customize this high-level summary in your review
settings.</sub>
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: rita-gorokhod

packages/server/api/src/app/flow-template/cloud-template.controller.ts

@@ -24,7 +24,7 @@ export const cloudTemplateController: FastifyPluginAsyncTypebox = async (
   }
 
   // cloud templates are available on any origin
-  app.addHook('onSend', allowAllOriginsHookHandler);
+  app.addHook('onRequest', allowAllOriginsHookHandler);
 
   app.get(
     '/',

packages/server/api/src/app/helper/allow-all-origins-hook-handler.ts

@@ -1,9 +1,8 @@
-import { onSendHookHandler } from 'fastify/types/hooks';
+import { onRequestHookHandler } from 'fastify/types/hooks';
 
-export const allowAllOriginsHookHandler: onSendHookHandler = (
+export const allowAllOriginsHookHandler: onRequestHookHandler = (
   request,
   reply,
-  payload,
   done,
 ) => {
   void reply.header(
@@ -21,9 +20,8 @@ export const allowAllOriginsHookHandler: onSendHookHandler = (
   void reply.header('Access-Control-Allow-Credentials', 'true');
 
   if (request.method === 'OPTIONS') {
-    return reply.status(204).send();
+    return void reply.status(204).send();
   }
 
-  done(null, payload);
-  return;
+  done();
 };

packages/server/api/src/app/user-info/user-info.module.ts

@@ -22,7 +22,7 @@ export const userInfoController: FastifyPluginAsyncTypebox = async (app) => {
   }
 
   // user-info is available on any origin
-  app.addHook('onSend', allowAllOriginsHookHandler);
+  app.addHook('onRequest', allowAllOriginsHookHandler);
 
   app.get(
     '/',