feat: add backend host setting and CORS

[paolino]

Summary

• Add backend CORS support for HTTP responses and OPTIONS preflight while preserving websocket upgrades.
• Add a persisted frontend backend host/URL setting that derives ws/wss URLs, reconnects on change, and keeps same-origin behavior when empty.
• Add focused backend/frontend tests plus render smoke coverage for the new setting.

Closes #39.

Verification

• ./gate.sh
• live riptide serve with headless UI check: Settings -> backend host set to the running server, websocket reconnected, engine returned connected
• curl -i -X OPTIONS -H 'Origin: http://foreign.example' -H 'Access-Control-Request-Method: GET' http://127.0.0.1:<port>/ returned 204 with CORS allow headers