fix(spoolman): remove SPOOLMAN_CORS_ORIGIN=* wildcard

[jpapiez]

Summary

Removes SPOOLMAN_CORS_ORIGIN=* from scripts/docker/compose-templates/docker-compose.spoolman.yml. In the upcoming Spoolman v0.26.1 image (upstream-synced fork), this wildcard completely disables a new CSRF/origin guard middleware — not just CORS. Upstream's trusts_all_origins() returns true whenever the value contains *, and add_trusted_origin_middleware() skips installing the guard entirely when that's the case.

Nothing in PrintFarmer relies on the wildcard:

• src/infra/Services/Spoolman/SpoolmanService.cs (backend HttpClient) never sets an Origin header.
• The React web UI only talks to our own proxy, src/api/Controllers/SpoolmanController.cs — no direct Spoolman URL is constructed client-side.
• The iOS app's SpoolService.swift also calls /api/spoolman/* exclusively.

The origin guard only inspects Origin on state-changing requests and trusts requests with no Origin header, so all of the above remain unaffected. Same-origin browsing of the Spoolman web UI (${SPOOLMAN_PORT:-7912}) is unaffected either, since same-origin requests don't carry a foreign Origin.

Closes #1682

Scope confirmation

Grepped the repo before changing anything — SPOOLMAN_CORS_ORIGIN appeared in exactly one place (this file, this line). No occurrence in .env.template, helm charts, or deploy-docker.sh.

Validation

• bash tests/test-compose-generator.sh — 67/67 passed.
• Regenerated a stack with scripts/docker/compose-generator.sh --include-spoolman and confirmed the generated spoolman service's environment: block now contains only TZ=${TZ:-UTC} — no SPOOLMAN_CORS_ORIGIN — and the YAML is otherwise valid.
• Branch is up to date with origin/development (fast-forward, no merge/conflicts needed — confirmed via git fetch origin && git merge origin/development → "Already up to date").

Not verifiable in this environment

• The cross-origin 403 behavior (issue's negative test) requires the fork's Spoolman image rebuilt on upstream v0.26.1. The currently deployed image is 0.24.5, which predates the origin guard entirely, so no live container in this environment can demonstrate the guard being active. This change is a no-op on 0.24.5 and becomes protective automatically once the image is rebuilt, per the issue's sequencing note.
• Full live Spoolman CRUD/health-check exercise (spools, filaments, vendors, barcode intake) was not re-run against a running container in this environment; the change touches only an environment variable that no PrintFarmer client sets or depends on, so no behavioral change is expected for these flows.

Pre-PR review gate

3-way adversarial review (Bishop, Hicks, Vasquez) completed on the branch prior to opening this PR — consensus 3/3 APPROVE. Verdicts will also be posted as PR comments in the canonical format for the squad/pre-pr-verdict gate.

[jpapiez]

Squad-Reviewer: bishop
Squad-Verdict: APPROVE
Squad-Head-SHA: 96b05bb

Diff is exactly the one-line removal of SPOOLMAN_CORS_ORIGIN=*. Grep confirms no other occurrence in the repo. No PrintFarmer client (backend HttpClient, React proxy controller, iOS app) sets an Origin header, so no functional regression. YAML remains valid.

[jpapiez]

Squad-Reviewer: vasquez
Squad-Verdict: APPROVE
Squad-Head-SHA: 96b05bb

Diff correctly removes only the wildcard CORS origin line. Repo-wide grep confirms no other definition site. No client code injects an Origin header that the new upstream guard would trip. No structural YAML issues introduced.

[jpapiez]

Squad-Reviewer: hicks
Squad-Verdict: APPROVE
Squad-Head-SHA: 96b05bb

Confirmed minimal diff, no remaining references to SPOOLMAN_CORS_ORIGIN in the repo, no Origin header set by Spoolman clients, YAML valid, and PR body correctly closes #1682.