auth: origin-scope the music app to /api/auth + /api/music

Add MUSIC_APP_ORIGIN to the origin allowlist and a global
originScopeMiddleware that restricts scoped app origins (the standalone
officer-music client) to their permitted path prefixes — /api/auth and
/api/music — and 403s everything else. The main web origin is unaffected,
and the gate no-ops while MUSIC_APP_ORIGIN is unset.

Lets extra sign-in-only users authenticate through the music app and reach
only music + auth, without reintroducing any per-user permission scheme.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/hono.ts

@@ -35,7 +35,7 @@ import { chatRouter } from './api/chat/chat';
 import { pipelineJobsRouter } from './api/tasks/pipeline-jobs-routes';
 import { broadcastPanelRefresh } from './api/terminal/websocket';
 import { CustomError } from './custom-errors';
-import { userMiddleware, bodyParser, isOriginAllowed } from './_middlewares';
+import { userMiddleware, bodyParser, isOriginAllowed, originScopeMiddleware } from './_middlewares';
 
 export { Hono };
 export { createRouter };
@@ -54,6 +54,10 @@ honoServer.use(
   }),
 );
 
+// Scoped-origin gate: restrict app origins (e.g. the music app) to their allowed path prefixes
+// (/api/auth + /api/music). No-ops for the main web origin and while MUSIC_APP_ORIGIN is unset.
+honoServer.use(originScopeMiddleware);
+
 honoServer.get('/api', (ctx) => ctx.json({ officerAPI: 'ok' }));
 honoServer.route('/api/auth', authRouter);
 honoServer.route('/api/landing-page-data', landingPageDataRouter);