fix(web): restrict browser CORS origins

[leemeo3]

Summary

Refs #135.

This tightens the local web API's browser CORS policy so JSON API responses no longer advertise Access-Control-Allow-Origin: *. Browser requests with an Origin header are now limited to loopback origins (localhost, 127.0.0.1, [::1]), and non-loopback origins receive a 403 response without CORS allow headers.

Why

The web UI/API is a local developer tool, but the previous wildcard CORS response allowed arbitrary websites visited in the same browser to make credentialless cross-origin requests to the local memory API. This PR keeps non-browser/local tool requests working while preventing random web origins from reading or mutating local memories through CORS.

Scope

• Adds a small shared CORS helper for the web server paths.
• Applies the same Origin gate to web-server.ts and the worker implementation.
• Handles preflight requests explicitly for allowed loopback origins.
• Adds regression coverage for allowed loopback origins, blocked external origins, and rejected responses without CORS allow headers.

This intentionally does not close #135 because that issue also tracks other security items, including auth and persistent prompt-injection hardening.

Validation

• npx bun test tests/web-server-cors.test.ts
• npx bun run typecheck
• npx bun run build
• npx bun test — 161 pass, 0 fail

AI assistance disclosure: this PR was prepared with Codex assistance and reviewed before submission.