Add loopback CORS support for Code Bridge

[shiny-code-bot]

Summary

• allow loopback browser origins to preflight Code Bridge /message and /events requests
• add CORS headers to loopback-origin bridge responses, including auth and payload errors browsers need to read
• document that browser clients need a fetch-based SSE reader because native EventSource cannot send the bridge auth/session headers

This is a prerequisite for the live browser-app witness in #36. It does not claim full browser automation yet.

Refs #36

Validation

• cargo fmt --manifest-path codex-rs/Cargo.toml --package codex-code-bridge-service -- --check
• cargo test --manifest-path codex-rs/Cargo.toml -p codex-code-bridge-service --no-fail-fast
• cargo test --manifest-path codex-rs/Cargo.toml -p codex-code-bridge-client browser_fixture_round_trips_nonblank_screenshot_and_control --no-fail-fast
• Review agents: CORS/security review found no issues; browser-prep review gaps were addressed with /events coverage and an SSE header limitation comment.