fix(local): return null from CORS origin callback for non-localhost origins

Returning a mismatched string still worked (browser blocks on mismatch)
but returning null correctly omits the Access-Control-Allow-Origin
header per Hono's CORS middleware API.

Author: MathurAditya724

src/commands/local.ts

@@ -115,7 +115,7 @@ function buildApp(
     "*",
     cors({
       origin: (origin) =>
-        LOCALHOST_ORIGIN_RE.test(origin) ? origin : "http://localhost",
+        LOCALHOST_ORIGIN_RE.test(origin) ? origin : null,
       allowMethods: ["GET", "POST", "OPTIONS"],
       allowHeaders: ["Content-Type", "Content-Encoding", "User-Agent"],
     })