fix(security): require origin checks and session tokens for render APIs

[ubugeeei]

Finding

Render mutation APIs such as reset, cancel, progress, audio plan, cache, and websocket state are unauthenticated on a fixed localhost port. Wildcard CORS increases CSRF/state-pollution risk.

Evidence

• backend/src/main.rs exposes render state mutation endpoints.
• The server binds 127.0.0.1:3000 with shared CORS handling.

Acceptance criteria

• Add a per-app-session token or equivalent capability check.
• Enforce trusted origins.
• Keep dev ergonomics documented.

[ubugeeei]

対応済みです。修正は PR #1 / commit 9cf4498 に反映済みです。