Allow the standalone Vite origin through CORS

`make dev-frontend` serves the SPA from localhost:5173 and talks to the
stack's backend, which refused it.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H7LwYgJfpkbLCTeiAf8U4A

docker/compose.local.yml

@@ -29,7 +29,9 @@ services:
     environment:
       - ENVIRONMENT=local
       - FRONTEND_HOST=http://app.${DOMAIN:-localhost}
-      - BACKEND_CORS_ORIGINS=http://${DOMAIN:-localhost},http://app.${DOMAIN:-localhost}
+      # Last entry: the standalone Vite dev server (`make dev-frontend`), which
+      # talks to this backend rather than running one of its own.
+      - BACKEND_CORS_ORIGINS=http://${DOMAIN:-localhost},http://app.${DOMAIN:-localhost},http://localhost:5173
 
   prestart:
     environment: