feat: CORS allowlist for cross-origin HTTP clients

[jonpepler]

Summary

Adds a configurable CORS allowlist so dashboards / SPAs hosted on a different origin (GitHub Pages, a local Vite dev server, a phone on the LAN) can read Telemachus action responses without needing a same-origin proxy.

Behaviour

• New ALLOWED_ORIGINS setting in PluginConfiguration (Telemachus/config.xml).
• Empty list (the default) preserves the historical behaviour of never sending CORS headers. Existing setups are unaffected.
• When configured:
  • Echoes the request's Origin in Access-Control-Allow-Origin if it matches the allowlist, with Vary: Origin. We echo rather than emit * — same permissiveness for configured clients, but blocks credentialed requests from arbitrary origins.
  • Responds 204 to OPTIONS preflight with standard Access-Control-Allow-Methods / Access-Control-Allow-Headers / Access-Control-Max-Age.
  • Non-allowlisted requests get no CORS header, so browsers block-by-default.

Config example

<string name="ALLOWED_ORIGINS">http://localhost:5173,https://your-dashboard.example</string>

Comma-separated. Trailing slashes and empty entries are stripped.

Test plan

• Build and start Telemachus, confirm Allowed CORS origins: … logs on init when config is set.
• With config set, curl -H "Origin: http://localhost:5173" -i http://127.0.0.1:8085/telemachus/datalink?a=v.altitude shows Access-Control-Allow-Origin: http://localhost:5173 + Vary: Origin.
• Same request from a non-allowlisted Origin returns no CORS header.
• OPTIONS preflight with allowlisted Origin returns 204 + the expected Access-Control-* headers.
• With config unset (default), responses include no CORS headers at all (verifies no regression for existing users).

[jonpepler]

Superseded by upstream PR TeaGuild#82 (re-targeting against TeaGuild)