origin validation: allowlist the Expo app origin via env

APP_ORIGINS now includes EXPO_PUBLIC_CLIENT_ORIGIN when set, so the mobile app's
officer:// custom-scheme origin passes origin validation without weakening it for
anyone else. The origin (with its embedded token) lives in .env, not the repo.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

src/servers/_middlewares/origin-validation.ts

@@ -1,7 +1,7 @@
 import type { MiddlewareHandler } from 'hono';
 import * as errors from '../custom-errors';
 
-const { PUBLIC_BUILD_ENV } = process.env;
+const { PUBLIC_BUILD_ENV, EXPO_PUBLIC_CLIENT_ORIGIN } = process.env;
 
 const WEB_ORIGINS: Record<string, string[]> = {
   alpha: ['https://alpha.officer.dev'],
@@ -13,8 +13,9 @@ const CHROME_EXTENSIONS: string[] = [
 ];
 
 const APP_ORIGINS: string[] = [
-  // Future: mobile app / webview origins
-];
+  // Expo mobile app — an officer:// custom-scheme origin (with an embedded token), set via env.
+  EXPO_PUBLIC_CLIENT_ORIGIN,
+].filter((o): o is string => Boolean(o));
 
 export function isOriginAllowed(origin: string | undefined, host?: string): boolean {
   if (!PUBLIC_BUILD_ENV || PUBLIC_BUILD_ENV === 'dev' || PUBLIC_BUILD_ENV === 'development') {