fix(cors): add prominent comment to preserve DELETE and PATCH methods

Added explicit comment warning to keep DELETE and PATCH methods in the
CORS defaultMethods array, preventing future accidental removals that
cause CORS errors for custom-content-delete and custom-urls operations.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

supabase/functions/_shared/cors.ts

@@ -38,8 +38,18 @@ export function getCorsHeaders(requestOrigin?: string, additionalMethods: string
     allowOrigin = allowedOrigins[0] || '*';
   }
 
-  // Default methods - include PATCH and DELETE for API operations
-  const defaultMethods = ['GET', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'];
+  // IMPORTANT: Keep all these methods in the list!
+  // DELETE is required for custom-content-delete and other delete operations.
+  // PATCH is required for custom-urls and update operations.
+  // Removing any method will cause CORS errors in the browser.
+  const defaultMethods = [
+    'GET',
+    'POST',
+    'PUT',
+    'PATCH',
+    'DELETE',
+    'OPTIONS'
+  ];
   const allMethods = [...new Set([...defaultMethods, ...additionalMethods])];
 
   return {