fix(server): allow protocol negotiation in CORS

Permit the canonical orchestration protocol header in browser API preflights so cross-origin web and desktop clients can negotiate compatibility while retaining authorization and DPoP headers.

Finding: D03

Model: GPT-5.6 Sol via Codex
22acb619edJulius Marminge committed on 9/5/2026, 4:54:28 AMparentf7511d3
2 files changedLine totals unavailable