How does Apigee handle CORS (Cross-Origin Resource Sharing)?

<!-- Step 1: Handle preflight OPTIONS requests
     These must return 200 immediately without hitting the backend -->
<Flow name="OptionsPreFlight">
  <Condition>request.verb == "OPTIONS"</Condition>
  <Request>
    <Step><Name>AM.AddCorsHeaders</Name></Step>
    <Step><Name>AM.ReturnOptions</Name></Step>  <!-- returns 200, no backend call -->
  </Request>
</Flow>

<!-- Step 2: Add CORS headers to all responses -->
<PostFlow name="PostFlow">
  <Response>
    <Step><Name>AM.AddCorsHeaders</Name></Step>
  </Response>
</PostFlow>

<!-- CORS headers AssignMessage policy -->
<AssignMessage name="AM.AddCorsHeaders">
  <AssignTo createNew="false" type="response"/>
  <Set>
    <Headers>
      <Header name="Access-Control-Allow-Origin">*</Header>
      <!-- Or restrict to specific origins:
      <Header name="Access-Control-Allow-Origin">
        {request.header.origin}
      </Header> -->
      <Header name="Access-Control-Allow-Methods">GET, POST, PUT, DELETE, OPTIONS</Header>
      <Header name="Access-Control-Allow-Headers">Content-Type, Authorization, x-api-key</Header>
      <Header name="Access-Control-Max-Age">3600</Header>
    </Headers>
  </Set>
</AssignMessage>

<!-- Return 200 for OPTIONS without calling backend -->
<AssignMessage name="AM.ReturnOptions">
  <AssignTo createNew="true" type="response"/>
  <Set><StatusCode>200</StatusCode></Set>
  <IgnoreUnresolvedVariables>true</IgnoreUnresolvedVariables>
</AssignMessage>