fix(app): replace CORS Access-Control-Allow-Origin * with explicit localhost origin

Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/server/dev-auth.ts

@@ -7,6 +7,7 @@ import type { IncomingMessage, ServerResponse } from 'http'
 
 const DEV_TOKEN = process.env.VITE_DEV_API_TOKEN ?? ''
 
+/** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
 /** Validate Authorization header. Returns true if authorized, false if rejected (response already sent). */
 export function validateDevAuth(req: IncomingMessage, res: ServerResponse): boolean {
   if (!DEV_TOKEN) return true // No token configured, skip auth
@@ -16,3 +17,20 @@ export function validateDevAuth(req: IncomingMessage, res: ServerResponse): bool
   res.end(JSON.stringify({ error: 'Unauthorized' }))
   return false
 }
+
+const ALLOWED_ORIGIN = 'http://localhost:5173'
+
+/** Set CORS headers with explicit localhost origin instead of wildcard. */
+export function setCorsHeaders(res: ServerResponse): void {
+  res.setHeader('Access-Control-Allow-Origin', ALLOWED_ORIGIN)
+}
+
+/** Write CORS preflight response. */
+export function handleCorsOptions(res: ServerResponse): void {
+  res.writeHead(204, {
+    'Access-Control-Allow-Origin': ALLOWED_ORIGIN,
+    'Access-Control-Allow-Methods': 'GET, POST, PUT, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+  })
+  res.end()
+}