Clean up bootstrap allowed origins

[danshapiro]

Summary

• keep generated ALLOWED_ORIGINS limited to production server origins
• emit dev companion origins through EXTRA_ALLOWED_ORIGINS during first-run bootstrap
• update docs/comments and bootstrap tests for the runtime NetworkManager contract

Verification

• npm run test:vitest -- test/unit/server/bootstrap.test.ts --run
• npm run test:vitest -- test/unit/server/network-manager.test.ts test/unit/server/bootstrap.test.ts test/server/ws-edge-cases.test.ts --run
• npm run verify
• npm run lint (0 errors, existing React hook warnings)