server: restrict default CORS to allowed origins

[TheodorNEngoy]

The inspector server currently installs cors() with default (permissive) settings.

This PR makes the default CORS policy match the existing origin allowlist logic:

• Allow only ALLOWED_ORIGINS (comma-separated) or default to loopback origins based on CLIENT_PORT.
• Still allows non-browser clients (no Origin header).
• Keeps the existing originValidationMiddleware in place (defense in depth).

This reduces the blast radius if the proxy auth is disabled (DANGEROUSLY_OMIT_AUTH) or misconfigured.

[TheodorNEngoy]

Local sanity check on this branch:

• npm run build-server

Build passes.

[cliffhall]

Closing: v1 is deprecated.

Thank you for this contribution, and apologies for the long wait for a response.

v1 will receive security fixes only. We reviewed every open v1 PR for security impact before closing — see the backlog triage in #1819 — and a small number were retained for a final 1.0.5 patch release. This one is a functionality, compatibility, or cleanup change rather than a vulnerability fix, so it is being closed unmerged. This is not a judgment on the quality of the work — it's a consequence of the branch it targets being frozen.

If the underlying problem still exists in v2, we'd genuinely like to know. Please open an issue describing it against v2. Note that we accept external contributions as issues rather than pull requests — maintainers handle design and implementation through a prompt-driven workflow. See CONTRIBUTORS.md.

Thanks again for taking the time to contribute to the Inspector.