fix(webapp): stop the dev server sending duplicate CORS headers

In local development, Vite's dev-server CORS middleware reflected the
request Origin on every Express response, on top of the app's own CORS
handling. The two layers produced a duplicated Access-Control-Allow-Origin
header, which browsers reject, breaking cross-origin API calls from a
separate frontend in dev. Disabling Vite's dev CORS lets the app be the
single source of CORS headers. Dev-only; production is unaffected.

Author: ericallam

apps/webapp/vite.config.ts

@@ -30,6 +30,7 @@ export default defineConfig({
     },
   },
   server: {
+    cors: false,
     warmup: {
       clientFiles: ["./app/entry.client.tsx", "./app/root.tsx", "./app/components/**/*.tsx"],
       ssrFiles: ["./app/entry.server.tsx", "./app/root.tsx"],