analytics: allow tldraw.dev without www (tldraw#6978)

### Change type

- [ ] `bugfix`
- [ ] `improvement`
- [ ] `feature`
- [ ] `api`
- [x] `other`

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> Adds `https://tldraw.dev` to CORS allowlists and mocks the consent
service in e2e tests for deterministic banner behavior.
> 
> - **Workers/CORS**:
> - Allow exact origin `https://tldraw.dev` in
`apps/analytics-worker/src/worker.ts` and
`packages/worker-shared/src/origins.ts`.
> - **Tests**:
> - In `apps/dotcom/client/e2e/tests/cookie-consent.spec.ts`, mock
`https://consent.tldraw.xyz` to always return `{ requires_consent: true,
country_code: 'TEST' }` to ensure the banner displays during tests.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
b8b83c4. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: mimecuvalo

apps/analytics-worker/src/worker.ts

@@ -15,6 +15,7 @@ function isAllowedOrigin(origin: string | null): string | undefined {
 	if (origin === 'http://localhost:3000') return origin
 	if (origin === 'http://localhost:5420') return origin
 	if (origin === 'https://meet.google.com') return origin
+	if (origin === 'https://tldraw.dev') return origin
 	if (origin.endsWith('.tldraw.com')) return origin
 	if (origin.endsWith('.tldraw.dev')) return origin
 	if (origin.endsWith('.tldraw.club')) return origin

apps/dotcom/client/e2e/tests/cookie-consent.spec.ts

@@ -7,6 +7,15 @@ test.use({ storageState: { cookies: [], origins: [] } })
 
 test.describe('cookie consent banner', () => {
 	test.beforeEach(async ({ page }) => {
+		// Mock the consent check to always require consent
+		await page.route('https://consent.tldraw.xyz', async (route) => {
+			await route.fulfill({
+				status: 200,
+				contentType: 'application/json',
+				body: JSON.stringify({ requires_consent: true, country_code: 'TEST' }),
+			})
+		})
+
 		await page.evaluate((key) => {
 			// eslint-disable-next-line no-restricted-syntax
 			window.localStorage.removeItem(key)

packages/worker-shared/src/origins.ts

@@ -21,6 +21,7 @@ export function isAllowedOrigin(origin: string) {
 	if (origin === 'http://localhost:3000') return origin
 	if (origin === 'http://localhost:5420') return origin
 	if (origin === 'https://meet.google.com') return origin
+	if (origin === 'https://tldraw.dev') return origin
 	if (origin.endsWith('.tldraw.com')) return origin
 	if (origin.endsWith('.tldraw.dev')) return origin
 	if (origin.endsWith('.tldraw.club')) return origin