Fix #7: Replace CORS wildcard with configurable origins

- cors_allowed_origins now uses CORS_ORIGINS from config (default: None)
- None restricts to same-origin only, blocking cross-site WebSocket hijacking
- Set CORS_ORIGINS in config.json or env var to allow specific domains

app.py

@@ -55,7 +55,7 @@ from flask_socketio import SocketIO, emit, join_room, disconnect
 from database import db, init_db
 from models import User, Message, UserIgnore
 from config import (
-    SECRET_KEY, ADMIN_PASSWORD, DATABASE_URL,
+    SECRET_KEY, ADMIN_PASSWORD, DATABASE_URL, CORS_ORIGINS,
     MAX_MSG_LEN, LOBBY, AI_FREE_LIMIT, AI_BOT_NAME,
     OLLAMA_URL, VIOLET_MODEL, VIOLET_SYSTEM,
     aesgcm_encrypt, aesgcm_decrypt, issue_jwt, verify_jwt,
@@ -312,7 +312,7 @@ def create_app() -> Flask:
     socketio.init_app(
         app,
         async_mode="eventlet",
-        cors_allowed_origins="*",
+        cors_allowed_origins=CORS_ORIGINS,
         message_queue=msg_queue,
         logger=False,
         engineio_logger=False,