fix(opencode): allow oc://renderer origin in cors middleware

[OpeOginni]

Issue for this PR

Closes #25075

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

• Packaged Electron desktop loads the renderer from the privileged oc://renderer scheme, but CORS preflights to the sidecar were returning 404 because the origin wasn't in the hardcoded allowlist.
• Add oc://renderer next to the existing localhost / tauri:// entries in CorsMiddleware, matching how the effect-httpapi backend already handles it (routes/instance/httpapi/server.ts:116).

Follows the style of the new EFFECT httpapi cors allowlist https://github.com/anomalyco/opencode/blob/dev/packages/opencode/src/server/routes/instance/httpapi/server.ts#L116

How did you verify your code works?

• bun typecheck in packages/opencode

Screenshots / recordings

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR