remove origin validation

ALLOW_ANY_ORIGIN, ALLOW_ANY_ORIGIN_MUSIC, and everything they gated. The flag
defaulted to ON, so none of it ran on a real install — what comes out is
documented defence in depth that was already switched off. The file said so
itself: "Both flags and their call sites come out once the tailnet is the
perimeter."

Origin was never authentication here in any case. An app's `officer://<hex>`
origin is chosen by the client, forgeable outside a browser, and extractable from
a shipped binary.

Gone: the two flags, isOriginAllowed, isOriginCheckDisabled, isMusicOriginExempt,
originValidationMiddleware, ORIGIN_RULES and the whole OFFICER_<APP>_ORIGIN
scheme, PUBLIC_URL's origin/host derivation, and origin-validation.test.ts, which
existed only to pin them. CORS now echoes whatever Origin it is given, which is
what every install already did.

What SURVIVES is the reason this needed care. origin-validation.ts held two
unrelated things, and the second was the global authorization gate — a valid
non-owner token reaches only what its role grants, deliberately NOT under the
flag because it is account-based rather than origin-based. Its own comment called
it "the airtight half". Deleting the file wholesale would have deleted
authorization.

So it moves to _middlewares/capability-gate.ts as capabilityGateMiddleware, with
the name matching what it does: nothing in it reads an Origin header any more.
hono.ts mounts it in the same position, ahead of every router.

origin-middleware.ts stays and is untouched — it extracts the Origin for six auth
handlers that log it, and for passkeys. Extraction, not validation.

Also updates every claim that rested on the old model: CLAUDE.md's security
section and repo map, docs/secret-store.md, docs/mobile-api-keys.md, and five
messages in machine-setup's Tailscale section which told the owner to set
ALLOW_ANY_ORIGIN=false when declining a tailnet. That advice is now impossible to
follow, and the honest version is different: with no tailnet the token is the
whole lock, so put a proxy in front and restrict who can reach it.

Not typechecked (empty node_modules, frozen installs). Every changed file parses;
the setup section was run and writes four variables now.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

docs/mobile-api-keys.md

@@ -213,7 +213,8 @@ both, so the endpoint cannot be used to discover whether an id exists.
 
 ## Things that will surprise you
 
-- **No `Origin` header is needed today.** `ALLOW_ANY_ORIGIN` defaults to on, so origin checking is off
+- **No `Origin` header is needed.** Origin checking was removed entirely on 2026-08-13; before that it
+  was off by default
   and the apps work sending none — which is what they do. Nothing here changes that. If it is ever
   switched off, every app breaks at once and will need its `OFFICER_<APP>_ORIGIN` value compiled in; that
   is a separate conversation, not part of this work.

docs/secret-store.md

@@ -147,7 +147,8 @@ The core is what `ecosystem.light.config.cjs` runs today — `officer`, `officer
 `officer-agent`, `officer-opencode`, `officer-pty` — **plus `officer-headscale`**.
 
 Headscale is core for a stated reason rather than by preference: `CLAUDE.md` says the tailnet *is* the
-perimeter, and that `ALLOW_ANY_ORIGIN` defaulting on is only defensible because of it. A security model
+perimeter — origin checking was removed on 2026-08-13 precisely because the tailnet is what stands in
+its place, so the tailnet is now load-bearing rather than one layer of two. A security model
 that rests on the tailnet cannot treat administering the tailnet as an optional extra. Vaultwarden and
 the wallet are not load-bearing that way — nothing else stops working without them — so they become
 plugins.