Pinecone CORS error: keep API calls server-side

# CORS: the browser is not the place for Pinecone calls

## The error

```
No 'Access-Control-Allow-Origin' header is present on the requested resource.
```

It appears when a browser-based app calls the Pinecone API cross-origin. Pinecone's CORS implementation is restrictive; a local dev server hostname in particular trips the same-origin policy because the browser treats it as a different origin from the machine's IP.

## Fix

Move Pinecone calls server-side. The browser talks to your backend; your backend talks to Pinecone with the API key. This also keeps the key out of shipped JavaScript, which is the more important win.

## What not to do

1. Do not proxy with `Access-Control-Allow-Origin: *` hacks around a key-bearing endpoint. You would be CORS-enabling key exfiltration.
2. Do not ship the API key in frontend code to "fix" the error. The CORS error was protecting you.
3. Local development: run the backend locally and have the frontend call it; do not call Pinecone directly from the page even in dev.

## Trap

Treating this as a Pinecone configuration issue. There is no dashboard toggle that makes browser-direct calls with a secret key safe. The architecture is the fix.