Fix CORS config: use str type to avoid pydantic-settings JSON parsing; fallback gracefully for env var format issues

Fix CORS config: change cors_origins to list[str] to avoid JSON decode error

Upload folder using huggingface_hub