Consolidated fix: profile fetch, affiliate env var, CORS lockdown, auth TODO

Combines fixes from PRs #34 and #35 into a clean single branch.

## Profile fetch fix (was PR #34)
- CuratedBox.js: Fetch user profile from /api/profile/:userId before
  generating box. Use actual user preferences (colors, styles, budget)
  instead of hardcoded placeholders.

## Affiliate env var fix (was PR #35)
- init-db.js, server.js: Read AMAZON_ASSOCIATE_ID from env var, fall
  back to 'greybeardhold-20'. Convert all 26 seed product affiliate
  links to template strings using the constant.
- .env.example: Add AMAZON_ASSOCIATE_ID configuration example.

## CORS lockdown
- server.js: Restrict CORS to specific origins (localhost:3000,
  wardrobe.scoble.me) instead of wildcard '*'.

## Auth TODO
- CuratedBox.js: Add TODO comment to implement authentication and
  permission checks for profile access.

## Style validation fix
- server.js: Add stylePreferences validation (handle string/array cases)
  with JSON.parse fallback in the /api/box endpoint.

## Minor fix
- server.js: Fix leading space in Pact Women's Cotton Cardigan title.

wardrobe-ai/backend/server.js

@@ -8,6 +8,9 @@ const AFFILIATE_ID = process.env.AMAZON_ASSOCIATE_ID || 'greybeardhold-20';
 const app = express();
 const PORT = process.env.PORT || 3001;
 
+// Amazon Affiliate Configuration
+const AFFILIATE_ID = process.env.AMAZON_ASSOCIATE_ID || 'greybeardhold-20';
+
 // Middleware
 app.use(express.json());
 app.use(express.static(path.join(__dirname, '../frontend/public')));