feat(remote): resolve backend URL from page origin instead of hardcod of hardcoded localhost

[heihei-github]

4-layer fix that derives the backend address dynamically from window.location.hostname so the same build works on localhost, LAN IP, or a public server without reconfiguration:

• CSP: inject current hostname into connect-src whitelist at runtime
• BackendUploader: add setDefaultBackendUrl() for pre-trace injection
• AI plugin: module-level IIFE sets backend URL from page origin
• Settings: auto-derive backendUrl when user hasn't set a custom one
• CORS: collect all non-loopback IPv4 addresses at startup

Change-Id: I1dc49a37a0966e1da2d444419a61471cc74c8a76

Summary

• Derive backend URL from window.location.hostname so the same build works on localhost, LAN IP, or a public server without reconfiguration
• CSP (connect-src) already present in upstream perfetto — this PR completes the remaining 4 layers
• Includes TS type fix for os.NetworkInterfaceInfo namespace error

Change Type

• feat (new capability)

Affected Areas

• backend/src/agentv3/ (config: getNonLoopbackOrigins CORS helper)
• perfetto/ui/src/plugins/com.smartperfetto.AIAssistant/ (frontend: plugin + session_manager + backend_uploader)

Done Conditions

• npm run test:scene-trace-regression from backend/ -> all 6 traces passed
• npx tsc --noEmit from backend/ -> green

Test Plan

1. cd backend && npm run test:scene-trace-regression — passes (6/6 traces)
2. cd backend && npx tsc --noEmit — no errors
3. Manual: load via http://localhost:10000 -> backend connects to localhost:3000
4. Manual: load via http://:10000 -> backend auto-connects to http://:3000

Risk / Rollback

Low risk. Changes are additive (new helper function, IIFE, settings override) with no existing behavior modified. Rollback: revert the commit.

Notes for Reviewers

Perfetto submodule points to commit f8ff26c8a (branch feat/remote-backend-url). This commit needs to exist on Gracker/perfetto before the submodule pointer resolves. CSP layer (http://${location.hostname}:3000 in connect-src) was
already merged upstream — see ui/src/frontend/index.ts line 177.

[Gracker]

Requesting changes. The SmartPerfetto wrapper does not yet make the remote/public-host setup work reliably without configuration. Please update the CORS strategy before landing.

[Gracker]

This only whitelists origins built from local non-loopback IPv4 addresses. It does not cover access through a hostname, public DNS name, or NAT/public IP, while the Perfetto-side change derives the backend URL from window.location.hostname. In those cases the browser origin can be http://my-host:10000 but serverConfig.corsOrigins will only include values like http://192.168.x.x:10000, so browser requests to http://my-host:3000 can still fail CORS. Please support the same hostname/public-host deployment path here, or document and require explicit CORS_ORIGINS instead of claiming it works without reconfiguration.

[heihei-github]

@Gracker 已按反馈重新实现：

把 cors({ origin: corsOrigins }) 改成了 origin 校验函数，
不再依赖启动时枚举的局域网 IP 白名单——任意 origin 只要
URL(origin).port === '10000' 就放行，无 Origin 头（curl/
服务端）也放行，其他一律拒绝。

这样 localhost / LAN IP / hostname / 公网 DNS 都能覆盖，
你之前提到的 http://my-host:10000 场景已通过。

[Gracker]

Verified the updated CORS strategy and the submodule pointer. SmartPerfetto root verify:pr passed on the PR head with the updated perfetto submodule.