Copilot Review Comments

PR #8198 (🔒 fix: RBAC follow-ups — CORS POST, reuse agentAuthHeaders, accurate header comment) was merged with 1 Copilot review comment(s) that should be addressed in a follow-up:

• pkg/agent/server_http.go:1976: setCORSHeaders still defaults Access-Control-Allow-Methods to "GET, OPTIONS" unless callers pass an explicit method list. There are existing kc-agent handlers that serve POST/DELETE (e.g., /serviceacc...

PR: #8198

Auto-generated by copilot-comment-followup workflow