security: add Origin header validation for CSRF protection

[cfsmp3]

Summary

• Validate Origin header on state-changing requests (POST, PUT, DELETE)
• Provide additional CSRF protection beyond SameSite cookies

Security Issue Addressed

No CSRF Protection on POST (Low) - Previously relied only on CORS headers for protection. This PR adds explicit Origin header validation on state-changing requests.

Changes

• backend/controllers/app_handlers.go:
  • Add isOriginAllowed() function to validate request origins
  • Update EnableCORS() to reject POST/PUT/DELETE requests from disallowed origins
  • Allow localhost origins in development mode (ENV != "production")
  • Log rejected requests for security monitoring
  • Set dynamic CORS Access-Control-Allow-Origin based on request origin

CSRF Protection Layers

With this PR, the application now has multiple layers of CSRF protection:

1. SameSite=Lax cookies (from PR fix: secure session cookies and validate WebSocket origin #405) - Prevents cross-site cookie sending
2. Origin header validation (this PR) - Rejects requests from disallowed origins
3. Session-based authentication - Requires valid session for protected endpoints

Test plan

• Verify requests from allowed origin work correctly
• Verify requests from disallowed origins are rejected (403 Forbidden)
• Verify localhost works in development mode
• Verify CORS preflight (OPTIONS) requests work correctly

🤖 Generated with Claude Code

[github-actions]

Thank you for opening this PR!

Before a maintainer takes a look, it would be really helpful if you could walk through your changes using GitHub's review tools.

Please take a moment to:

• Check the "Files changed" tab
• Leave comments on any lines for functions, comments, etc. that are important, non-obvious, or may need attention
• Clarify decisions you made or areas you might be unsure about and/or any future updates being considered.
• Finally, submit all the comments!

More information on how to conduct a self review:
https://docs.github.com/en/pull-requests/collaborating-with-pull-requests/reviewing-changes-in-pull-requests/reviewing-proposed-changes-in-a-pull-request

This helps make the review process smoother and gives us a clearer understanding of your thought process.

Once you've added your self-review, we'll continue from our side. Thank you!

[its-me-abhishek]

Can add w.Header().Add("Vary", "Origin") before the response, to prevent caching at all (if required) else looks okay to me.