fix(desktop): WS live feed offline — native plugin sends no Origin header

Login worked after the mixed-content fix, but the live feed 403'd silently:
tauri-plugin-websocket's connect() runs on Tauri's Rust side, not inside the
webview page, so it never auto-attaches Origin the way a browser WebSocket
would — routes/ws.ts's anti-CSWSH check rejects a missing Origin before
auth. platform-ws.ts now sets Origin: tauri://localhost explicitly.

Also fixes a second, independent gap the above alone wouldn't have caught:
komodo/resources.toml's booth Stacks had WS_ALLOWED_ORIGINS= empty in
production despite .env.example documenting it as required for desktop.
Needs a Komodo sync + redeploy to reach a live booth.

wiki/decisions/desktop-shell-tauri.md

@@ -164,6 +164,19 @@ Per the user's choices — the operator **keeps OS access** (no fullscreen lockd
   - `logger.ts`'s `flushBeacon()` (page-hide `navigator.sendBeacon`) is a native browser API with no
     Tauri equivalent — it still drops silently in the desktop shell on unload. Accepted: the regular
     4s-interval flush (now fixed, routes through `platformFetch`) covers the common case.
+  - **Gotcha (found immediately after shipping the above): the native WS plugin sends no `Origin`
+    header.** `tauri-plugin-websocket`'s `connect()` runs on Tauri's Rust side, not inside the
+    webview page — there's no page context to auto-attach `Origin: tauri://localhost` the way a real
+    browser `WebSocket` would. The server's anti-CSWSH check (`routes/ws.ts`, `isAllowedOrigin`)
+    treats a missing Origin as untrusted and 403s the handshake before touching auth — the live feed
+    showed **"JASHTË LINJË"** (offline) in the desktop app while the browser showed **"LIVE"**, same
+    server, same moment. **Fix (two parts, both needed):** `platform-ws.ts`'s `connect()` call now
+    passes `{ headers: { Origin: "tauri://localhost" } }` explicitly; separately, `komodo/
+    resources.toml`'s booth Stacks had `WS_ALLOWED_ORIGINS=` **empty** in production (despite
+    `.env.example` documenting `tauri://localhost,http://tauri.localhost` as required) — even a
+    correct Origin header is useless if the server's allowlist doesn't include it. Both fixed
+    together; a `resources.toml` change still needs a Komodo sync + Stack redeploy to take effect on
+    a live booth, it isn't automatic from a git push alone.
 - **`VITE_API_BASE` — desktop vs. browser (regression found + fixed 2026-09-03):**
   `apps/web/.env.production` (committed, shared by both builds) sets `VITE_API_BASE=` (empty) — this
   is correct for the **browser/booth** build (Fastify same-origin, stays relative) since commit