DUNGEONS-34: add one-command app launcher

Co-authored-by: multica-agent <github@multica.ai>

backend/src/main.rs

@@ -71,6 +71,7 @@ struct App {
     key: Arc<Vec<u8>>,
     setup: Arc<String>,
     origin: Arc<String>,
+    allowed_origins: Arc<Vec<String>>,
     secure: bool,
     peers: Arc<Mutex<Peers>>,
     limits: Arc<Mutex<HashMap<String, (i64, u32)>>>,
@@ -232,11 +233,14 @@ async fn guard(State(app): State<App>, req: Request, next: Next) -> Response {
         axum::http::Method::GET | axum::http::Method::HEAD | axum::http::Method::OPTIONS
     );
     if (mutation || req.uri().path() == "/api/signal")
-        && req
+        && !req
             .headers()
             .get(header::ORIGIN)
             .and_then(|v| v.to_str().ok())
-            != Some(app.origin.as_str())
+            .is_some_and(|origin| {
+                origin == app.origin.as_str()
+                    || app.allowed_origins.iter().any(|allowed| allowed == origin)
+            })
     {
         return ApiError(StatusCode::FORBIDDEN, "origin").into_response();
     }
@@ -701,6 +705,15 @@ async fn main() -> Result<(), Box<dyn std::error::Error>> {
         key: Arc::new(key.into_bytes()),
         setup: Arc::new(setup),
         secure: origin.starts_with("https://"),
+        allowed_origins: Arc::new(
+            std::env::var("WEBKA_ALLOWED_ORIGINS")
+                .unwrap_or_default()
+                .split(',')
+                .map(str::trim)
+                .filter(|s| !s.is_empty())
+                .map(str::to_owned)
+                .collect(),
+        ),
         origin: Arc::new(origin),
         peers: Default::default(),
         limits: Default::default(),