fix(server): allow protocol negotiation in CORS

Permit the canonical orchestration protocol header in browser API preflights so cross-origin web and desktop clients can negotiate compatibility while retaining authorization and DPoP headers.

Finding: D03

Model: GPT-5.6 Sol via Codex
f4b285b8a7Julius Marminge committed on 9/1/2026, 4:33:02 AMparent8c3e834
2 files changedLine totals unavailable