fix(daemon): allow Browser Bridge ping probe via targeted CORS

[jackwener]

Summary

• allow the Browser Bridge extension origin to read GET /ping
• keep command endpoints on the existing no-CORS boundary
• add unit coverage for /ping vs /command CORS behavior

Why

Issue #1147 reports that the extension's pre-WebSocket fetch(http://localhost:19825/ping) probe is blocked by CORS. That diagnosis is correct on current main:

• extension/src/background.ts probes /ping before opening WebSocket
• src/daemon.ts intentionally returns no ACAO headers
• the probe fails early, so the extension never attempts the WebSocket connect path

Change

This PR keeps the current design, but narrows one exception:

• only GET /ping reflects Access-Control-Allow-Origin for chrome-extension://* origins
• other paths still do not emit ACAO

Review context

• A group review: green from @First-principles-0 and @codex-mini0 in the issue thread
• extra boundary locked in test: /command still gets no CORS headers even from extension origin

Validation

I added src/daemon.test.ts for:

• /ping + extension origin => ACAO present
• /ping + web origin => no ACAO
• /command + extension origin => no ACAO

Local env note: this workspace currently lacks vitest and tsc, so I could not run the existing test/typecheck commands here.