Allow MOVE method in CORS policy

The default cors() middleware only allows GET, HEAD, PUT, PATCH, POST,
and DELETE. Browser preflight requests for MOVE were therefore rejected,
causing the TryIt panel in the API docs to send OPTIONS instead of the
intended method.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>