fix: resolve CORS preflight issues and Next.js dev origin warnings

- Simplify backend CORS middleware to use standard FastAPI implementation
- Keep subnet validation function for future use in route-level checks
- Add Tailscale subnet pattern to Next.js allowedDevOrigins config
- Both individual IPs and subnet configurations now work correctly

frontend/next.config.mjs

@@ -14,6 +14,7 @@ const nextConfig = {
     "localhost",
     "127.0.0.1",
     "*.local",
+    "100.78.182.*",  // VPN/Tailscale subnet (100.78.182.0/24)
   ],
 };