fix(app): replace CORS Access-Control-Allow-Origin * with explicit localhost origin

Add setCorsHeaders() and handleCorsOptions() helpers in server/dev-auth.ts.
Replace wildcard CORS origin with http://localhost:5173 in all Vite plugins
and claude-proxy.ts. Include Authorization in allowed CORS headers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/vite-rss.ts

@@ -1,7 +1,7 @@
 import type { Plugin } from 'vite'
 import type { Connect } from 'vite'
 import Parser from 'rss-parser'
-import { validateDevAuth } from './server/dev-auth'
+import { validateDevAuth, setCorsHeaders } from './server/dev-auth'
 
 export interface RssArticle {
   title: string
@@ -140,7 +140,7 @@ function createRssMiddleware() {
     try {
       const articles = await fetchRssFromUrls(safe)
       res.setHeader('Content-Type', 'application/json')
-      res.setHeader('Access-Control-Allow-Origin', '*')
+      setCorsHeaders(res)
       res.setHeader('Cache-Control', 'public, max-age=300')
       res.end(JSON.stringify({ articles }))
     } catch (err) {