feat(serve-sim): allow scoped cross-origin reads of /metrics

[gwdp]

Optional follow-up to #132 (metrics): lets an allowlisted external dashboard read the /metrics SSE stream cross-origin.

serve-sim's own preview UI reads /metrics same-origin over the exec socket, so this isn't needed for the built-in tools panel — it's for a separately-hosted dashboard on another origin.

• --metrics-cors-origin <origin> (repeatable, or comma-separated) allowlists origins; loopback is always allowed, never a wildcard. Control routes stay same-origin + token-gated.
• Origins are compared canonically (new URL(o).origin), so :443, a trailing slash, or casing still match; malformed values are skipped.

Stacked on #132 — this diff includes the metrics commits until #132 lands, then reduces to just the CORS change. Merge #132 first.

Tests, lint, and native build pass.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 7737844a-c7c1-4ffa-88ae-ef966282c646

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}