fix: hardcode paseo://app as allowed CORS origin in daemon bootstrap

The desktop app uses the paseo:// custom protocol scheme, but the
origin was only passed via PASEO_CORS_ORIGINS when the desktop started
the daemon itself. If the daemon was started by the CLI, the origin
was missing and the Electron renderer's WebSocket connection was
rejected.

Also removes file:// and null from allowed origins — any page loaded
via file:// could connect to the daemon, which is a security gap.

packages/desktop/src/daemon/daemon-manager.ts

@@ -148,8 +148,6 @@ function buildDesktopDaemonCorsOriginsEnv(): string | undefined {
       .filter((value) => value.length > 0),
   );
 
-  origins.add("paseo://app");
-
   const devServerUrl = process.env.EXPO_DEV_URL ?? DEFAULT_ELECTRON_DEV_SERVER_URL;
   try {
     const parsed = new URL(devServerUrl);

packages/server/src/server/bootstrap.ts

@@ -249,9 +249,8 @@ export async function createPaseoDaemon(
     // CORS - allow same-origin + configured origins
     const allowedOrigins = new Set([
       ...config.corsAllowedOrigins,
-      // Packaged desktop renderers may send `file://` or `null` as the origin.
-      "file://",
-      "null",
+      // Packaged desktop renderers use the custom paseo:// protocol scheme.
+      "paseo://app",
       // For TCP, add localhost variants
       ...(listenTarget.type === "tcp"
         ? [