test: update tests for security fixes (origin validation, streaming state)

- archyIntegration: expect window.location.origin instead of '*' for
  postMessage calls (matches FIX-009 origin restriction)
- useAI: fix flaky isStreaming assertion to account for background
  fetch calls (refreshWavlakeCatalog) captured before streaming starts

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/app/src/__tests__/useAI.test.ts

@@ -223,8 +223,9 @@ describe('useAI', () => {
       expect(chatStore.isStreaming).toBe(false)
       await sendMessage('hi')
       expect(chatStore.isStreaming).toBe(false)
-      // During the fetch call, isStreaming should have been true
-      expect(streamingStates[0]).toBe(true)
+      // During the streaming fetch call, isStreaming should have been true
+      // (earlier non-streaming fetches like refreshWavlakeCatalog may also be captured)
+      expect(streamingStates.some(s => s === true)).toBe(true)
     })
 
     it('handles stream errors gracefully', async () => {