server: restrict default CORS to allowed origins

[TheodorNEngoy]

The inspector server currently installs cors() with default (permissive) settings.

This PR makes the default CORS policy match the existing origin allowlist logic:

• Allow only ALLOWED_ORIGINS (comma-separated) or default to loopback origins based on CLIENT_PORT.
• Still allows non-browser clients (no Origin header).
• Keeps the existing originValidationMiddleware in place (defense in depth).

This reduces the blast radius if the proxy auth is disabled (DANGEROUSLY_OMIT_AUTH) or misconfigured.

[TheodorNEngoy]

Local sanity check on this branch:

• npm run build-server

Build passes.