fix(daemon): harden security against browser CSRF attacks

[jackwener]

Changes

• Add Origin header check: reject HTTP/WS from non chrome-extension:// origins
• Require X-OpenCLI custom header on all HTTP requests
• Remove Access-Control-Allow-Origin: * from all responses
• Add WebSocket verifyClient to reject malicious connections at upgrade phase
• Add 1MB body size limit to prevent OOM
• Update file header with security model documentation

Files Changed

• src/daemon.ts — server-side security checks
• src/browser/daemon-client.ts — add X-OpenCLI: 1 header to CLI fetch calls
• src/browser/discover.ts — add X-OpenCLI: 1 header to status check

Testing

• 306 unit tests pass
• Local smoke test: verified all 6 attack vectors are properly blocked

Closes #268