fix: add rotation direction indicators and fix CORS for dev origins

- Add TOP/BTM labels to rotated box showing which edge is which after rotation
- Allows user to visually see rotation direction without calculating degrees
- Fix allowedDevOrigins to include common private IP ranges (192.168.*, 10.*, 172.16.*)
- Resolves CORS warning when accessing from local network IPs

frontend/next.config.mjs

@@ -14,7 +14,7 @@ const nextConfig = {
   // Format: comma-separated list (e.g., "localhost,127.0.0.1,*.local,100.78.182.*")
   allowedDevOrigins: process.env.ALLOWED_DEV_ORIGINS
     ? process.env.ALLOWED_DEV_ORIGINS.split(',').map(o => o.trim())
-    : ["localhost", "127.0.0.1", "*.local"],
+    : ["localhost", "127.0.0.1", "*.local", "192.168.*", "10.*", "172.16.*"],
 };
 
 export default withPWA(nextConfig);