fix: handle empty BACKEND_CORS_ORIGINS env var to prevent JSONDecodeError

In pydantic_settings v2, List[str] fields are JSON-parsed by the env
source before pydantic validators run. When BACKEND_CORS_ORIGINS=""
(empty string) in Kubernetes, json.loads("") raised JSONDecodeError,
crashing alembic migrations.

Fixes:
- Add env_ignore_empty=True to class Config so pydantic_settings skips
  empty-string env vars and falls back to the field default
- Update assemble_cors_origins validator to explicitly handle empty and
  whitespace-only strings (returns []), JSON array strings (parsed via
  json.loads), and filters empty tokens from comma-separated values
- Add backend/app/tests/test_config.py covering all CORS origins
  parsing scenarios including the empty-string regression case

Agent-Logs-Url: https://github.com/christianlouis/dmarq/sessions/53bb1064-2a32-4691-8397-9d4663bc18a8

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

backend/app/core/config.py

@@ -1,3 +1,4 @@
+import json
 import logging
 import secrets
 from functools import lru_cache
@@ -77,15 +78,21 @@ class Settings(BaseSettings):
     def assemble_cors_origins(  # pylint: disable=no-self-argument
         cls, v: Union[str, List[str]]
     ) -> List[str]:
-        if isinstance(v, str) and not v.startswith("["):
-            return [i.strip() for i in v.split(",")]
-        if isinstance(v, (list, str)):
+        if isinstance(v, str):
+            v = v.strip()
+            if not v:
+                return []
+            if v.startswith("["):
+                return json.loads(v)
+            return [i.strip() for i in v.split(",") if i.strip()]
+        if isinstance(v, list):
             return v
         raise ValueError(v)
 
     class Config:
         env_file = ".env"
         case_sensitive = True
+        env_ignore_empty = True
 
 
 @lru_cache()