fix(server): restrict CORS and bind local API to loopback (CWE-352)

The local Electron HTTP server (server.js) exposes endpoints that spawn
child processes (/executeTask), read/write task and config files
(/manageTask, /setUserDataFolder, /deleteTask), and otherwise perform
state-changing actions, but it has no authentication and previously sent
'Access-Control-Allow-Origin: *' on every response.

Because the server listens on a predictable local port, any website the
user visited could issue cross-origin POSTs to drive task creation and
execution (CWE-352 / CSRF).

This change:
- Removes the unconditional ACAO:* header.
- Echoes Access-Control-Allow-Origin only for loopback origins
  (http(s)://localhost, 127.0.0.1, [::1]).
- Rejects requests with a non-local Origin header with HTTP 403.
- Handles CORS preflight (OPTIONS) safely.
- Binds the HTTP server (port 8074) and Express upload server
  (port 8075) to 127.0.0.1 only, so they are not exposed on the LAN.
- Restricts the express 'cors' middleware to the same loopback allowlist.