feat(dev): bind Vite to 0.0.0.0 for LAN access (phone over wifi)

Vite had no host set (localhost only). Bind 0.0.0.0 so the dev booth UI is
reachable from other LAN devices at http://<host-lan-ip>:5173. The SPA
already uses relative paths + the page origin for API and the live WS, so
no app code changes — but loading from a non-localhost origin means the
/api/ws handshake's Origin is the LAN address, which the backend's
WS_ALLOWED_ORIGINS must include (documented in .env.example; the host's own
.env is gitignored).

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

apps/server/.env.example

@@ -42,6 +42,9 @@ EVENT_SIGNING_KEY=
 # The Tauri DESKTOP shell loads from tauri://localhost (Linux may also send
 # http://tauri.localhost), which is NOT same-origin with the backend — add both
 # so the desktop app's live feed connects. See apps/desktop.
+# To open the dev SPA from another LAN device (phone over wifi), Vite must bind
+# 0.0.0.0 (vite.config.ts) AND the host's LAN origin must be listed here, e.g.
+# http://10.0.10.203:5173 — the WS handshake's Origin is that LAN address.
 WS_ALLOWED_ORIGINS=http://localhost:5173,tauri://localhost,http://tauri.localhost
 
 # Vision / ANPR (optional) -------------------------------------------------

apps/web/vite.config.ts

@@ -9,6 +9,12 @@ export default defineConfig({
   plugins: [react(), tailwindcss()],
   server: {
     port: 5173,
+    // Bind all interfaces so the dev SPA is reachable from other LAN devices
+    // (phone over wifi, etc.) at http://<host-lan-ip>:5173 — not just localhost.
+    // NB: loading from a non-localhost origin means the booth WebSocket (/api/ws)
+    // sends Origin: http://<host-lan-ip>:5173, which the backend's WS_ALLOWED_ORIGINS
+    // must include or the live feed is rejected. See apps/server/.env(.example).
+    host: "0.0.0.0",
     proxy: {
       // Use 127.0.0.1 (not "localhost") so the proxy never tries IPv6 ::1
       // first and stall — the backend binds IPv4. Avoids slow/hung requests,