security(web): disable CORS on Vite dev server

Restrict CORS on the development server to prevent malicious websites
from reading source files. This addresses the esbuild CVE pattern where
`Access-Control-Allow-Origin: *` allows any site to fetch dev server files.

Note: This only affects `vite dev`, not production builds or deployments.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: WuMingDao

apps/web/vite.config.ts

@@ -5,6 +5,11 @@ import { defineConfig } from 'vite'
 
 // https://vite.dev/config/
 export default defineConfig({
+  server: {
+    // Security: Restrict CORS in development
+    // Only allow requests from same origin by default
+    cors: false,
+  },
   plugins: [
     react({
       babel: {