fix(server): allow localhost and loopback development origins

[Sunwood-ai-labs]

Opening the development UI at http://localhost:5173 and posting through Vite's /api proxy returns 403 (Cross-origin requests are not allowed.), because the server previously allowed only http://127.0.0.1:5173 by default.

Allow both loopback browser origins in development and support an explicit comma-separated APP_ORIGIN list. Configured origins continue to match the scheme, hostname, and port exactly; Host checks, cross-site request blocking, and owner-token authentication remain enforced. Outside development, an unset APP_ORIGIN continues to require the request URL's origin.

Changes

• Accept a single origin or an origin array in the API middleware.
• Extract origin configuration resolution and document development defaults, explicit overrides, and list syntax in .env.example and the setup guide.
• Add regression coverage for both Vite browser URLs, production defaults, configuration parsing, restrictive blank lists, unauthorized origins, cross-site requests, unrecognized hosts, and owner authentication.

Validation

Windows, Node.js 24.15.0:

• npm test: 35 files / 179 tests passed (including 29 origin configuration/API tests).
• npm run typecheck: passed.
• npm run lint: passed.
• npm run check-format: passed with a temporary LF checkout matching Linux CI.
• npm run build: passed.
• git diff --check: passed.

The baseline Windows CRLF checkout and npm run dev portability problems are tracked separately by #34 and #35. No unrelated line-ending changes are included in this PR.