fix(desktop): WS live feed offline — native plugin sends no Origin header

Login worked after the mixed-content fix, but the live feed 403'd silently:
tauri-plugin-websocket's connect() runs on Tauri's Rust side, not inside the
webview page, so it never auto-attaches Origin the way a browser WebSocket
would — routes/ws.ts's anti-CSWSH check rejects a missing Origin before
auth. platform-ws.ts now sets Origin: tauri://localhost explicitly.

Also fixes a second, independent gap the above alone wouldn't have caught:
komodo/resources.toml's booth Stacks had WS_ALLOWED_ORIGINS= empty in
production despite .env.example documenting it as required for desktop.
Needs a Komodo sync + redeploy to reach a live booth.

apps/web/src/lib/platform-ws.ts

@@ -62,7 +62,13 @@ class TauriSocketAdapter implements PlatformSocket {
     try {
       const { default: TauriWebSocket } = await import("@tauri-apps/plugin-websocket");
       if (this.#closed) return; // close() called before connect resolved
-      const conn = await TauriWebSocket.connect(url);
+      // Runs on Tauri's native (Rust) side, NOT inside the webview page — there
+      // is no page context to auto-attach an Origin header the way a real
+      // browser WebSocket would. The server's anti-CSWSH check (routes/ws.ts)
+      // rejects any handshake with a missing/mismatched Origin, so it must be
+      // set explicitly here to match what WS_ALLOWED_ORIGINS expects
+      // (tauri://localhost — see apps/server/.env.example).
+      const conn = await TauriWebSocket.connect(url, { headers: { Origin: "tauri://localhost" } });
       if (this.#closed) {
         void conn.disconnect();
         return;
@@ -78,7 +84,8 @@ class TauriSocketAdapter implements PlatformSocket {
         // routes/ws.ts) — nothing else is expected.
       });
       this.onopen?.();
-    } catch {
+    } catch (err) {
+      console.error("Tauri WebSocket connect failed:", url, err);
       this.onerror?.();
       this.onclose?.();
     }