fix(cors): preserve network error responses

[PhuocOng]

Summary

Fixes #161.

Preserve Response.error() in addCorsHeaders instead of rebuilding it with status 0, which throws a RangeError. Network-error responses have no HTTP headers to augment; regular HTTP responses keep the existing CORS behavior.

Adds regression coverage for default/custom CORS and the public handler/pipeline forms, plus HTTP 400/500 controls that preserve status, body and CORS headers.

Verification

• Before the fix: the baseline passes 476 tests; the added regression fails at the Response constructor.
• Exact PR commit CI: tests, typecheck, lint, build, dependency/exports checks, raw-Node and packed-package smoke tests, and JSR packaging dry-run pass.
• Ubuntu and Windows: 483 tests pass with no skips, plus typecheck, lint, build and changed-file formatting.
• Existing E2E suite: all 100 tests pass against disposable Supabase, covering four adapters, core Node and the Deno Edge runtime, with real JWT/JWKS and RLS queries.

The PR's source matches the cross-platform/E2E-tested commit exactly. Additional validation workflow settings remain on the fork and are not part of this PR. Runtime tests ran on GitHub-hosted runners.

AI-assisted with GitHub Copilot.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/@supabase/server@162

commit: 63d579f