temporarily allow any origin on /api/music

Off unless ALLOW_ANY_ORIGIN_MUSIC=true, so it is opt-in per host and reverting is an env
edit rather than a deploy. Set on this host now; the flag and the two call sites come out
when the tailnet becomes the perimeter and the music app stops needing to be public.

It drops one layer, not the lock: /api/music still requires a valid token through
userMiddleware, and the non-owner account backstop in originScopeMiddleware still confines
music accounts to /api/auth + /api/music whatever Origin they claim. Worth being plain
about what is lost — Origin was never authentication here. `officer://<hex>` is chosen by
the client, trivially forged outside a browser, and extractable from any shipped app
binary. It is defence in depth, and this removes it for one path prefix.

Two gates had to know: userMiddleware, which is what actually 403s, and the CORS origin
callback, which would otherwise echo an empty origin and block a browser client that
userMiddleware had already allowed through.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/servers/hono.ts

@@ -43,6 +43,7 @@ import { pipelineJobsRouter } from './api/tasks/pipeline-jobs-routes';
 import { broadcastPanelRefresh } from './api/terminal/websocket';
 import { CustomError } from './custom-errors';
 import { userMiddleware, bodyParser, isOriginAllowed, originScopeMiddleware } from './_middlewares';
+import { isMusicOriginExempt } from './_middlewares/origin-validation';
 
 export { Hono };
 export { createRouter };
@@ -54,6 +55,9 @@ honoServer.use(
   cors({
     origin: (origin, c) => {
       const host = c.req.header('host');
+      // TEMPORARY: see isMusicOriginExempt — echoes any Origin back for /api/music when enabled, so a
+      // browser client is not blocked by CORS after userMiddleware has already let it through.
+      if (isMusicOriginExempt(c.req.path)) return origin ?? '*';
       return isOriginAllowed(origin, host) ? origin : '';
     },
     allowMethods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],