chore(cors): broaden local origin matching for dev environments

[IamCoder18]

Summary

The dev-environment CORS origin check in both services previously used origin.startsWith('http://localhost:'), which rejects every other loopback/LAN address even though they are still local-only traffic. That meant requests from http://192.168.x.x, http://10.x.x.x, http://127.0.0.1, and similar local addresses all failed with standard CORS preflight errors in the browser console.

Closes #4011

The fix replaces the single prefix check with a regex that matches:

• localhost
• IPv4 loopback: 127.x.x.x
• RFC1918 private ranges: 10.x.x.x, 172.16-31.x.x, 192.168.x.x
• IPv6 local addresses: ::1, fd00::/8 ULA, fe80::/10 link-local

All with optional ports and case-insensitive scheme matching.

Files changed:

• services/gastown/src/gastown.worker.ts
• services/wasteland/src/wasteland.worker.ts

Verification

• Verified locally that http://192.168.x.x origins are accepted in dev.

Visual Changes

N/A

Reviewer Notes

This regex is consistent between gastown and wasteland so the two services don't drift on what counts as "local". If we ever want to additionally allow host.docker.internal or .local mDNS names, that belongs in a follow-up change.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Executive Summary

Both previously flagged regex hoisting issues are resolved; localIpPattern is now defined at module scope in both workers and the broadened CORS regex is correctly structured.

Previously Flagged Issues (now resolved)

File	Line	Issue	Status
services/gastown/src/gastown.worker.ts	271	localIpPattern hoisted to module scope	✅ Fixed
services/wasteland/src/wasteland.worker.ts	94	localIpPattern hoisted to module scope	✅ Fixed

Files Reviewed (2 files)

• services/gastown/src/gastown.worker.ts
• services/wasteland/src/wasteland.worker.ts

---

_{Reviewed by claude-4.6-sonnet-20260217 · 245,888 tokens}

_{Review guidance: REVIEW.md from base branch main}

[IamCoder18]

Ready to review!