fix: add rotation direction indicators and fix CORS for dev origins

- Add TOP/BTM labels to rotated box showing which edge is which after rotation
- Allows user to visually see rotation direction without calculating degrees
- Fix allowedDevOrigins to include common private IP ranges (192.168.*, 10.*, 172.16.*)
- Resolves CORS warning when accessing from local network IPs

frontend/components/DebugRotationPanel.tsx

@@ -131,6 +131,16 @@ export function DebugRotationPanel({
       ctx.translate(cropX + cropW / 2, cropY + cropH / 2);
       ctx.rotate((rotation * Math.PI) / 180);
       ctx.strokeRect(-cropW / 2, -cropH / 2, cropW, cropH);
+
+      // Add direction markers to rotated box
+      ctx.setLineDash([]);
+      ctx.fillStyle = '#FFB800';
+      ctx.font = 'bold 12px monospace';
+      ctx.textAlign = 'center';
+      ctx.textBaseline = 'middle';
+      ctx.fillText('↑ TOP', 0, -cropH / 2 - 10);
+      ctx.fillText('↓ BTM', 0, cropH / 2 + 10);
+
       ctx.restore();
     }
 

frontend/next.config.mjs

@@ -14,7 +14,7 @@ const nextConfig = {
   // Format: comma-separated list (e.g., "localhost,127.0.0.1,*.local,100.78.182.*")
   allowedDevOrigins: process.env.ALLOWED_DEV_ORIGINS
     ? process.env.ALLOWED_DEV_ORIGINS.split(',').map(o => o.trim())
-    : ["localhost", "127.0.0.1", "*.local"],
+    : ["localhost", "127.0.0.1", "*.local", "192.168.*", "10.*", "172.16.*"],
 };
 
 export default withPWA(nextConfig);