refactor: remove all hardcoded IPs/subnets, use environment variables only

- Next.js allowedDevOrigins now loaded from ALLOWED_DEV_ORIGINS env var
- start_server.sh generates ALLOWED_DEV_ORIGINS from EXTRA_ALLOWED_ORIGINS
- Subnet notation (10.0.0.0/24) auto-converts to wildcard patterns (10.0.0.*)
- Individual IPs convert to subnet patterns (192.168.1.100 -> 192.168.1.*)
- Zero hardcoded IPs in source code - all from inventory.env

frontend/next.config.mjs

@@ -10,12 +10,11 @@ const withPWA = withPWAInit({
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: "standalone",
-  allowedDevOrigins: [
-    "localhost",
-    "127.0.0.1",
-    "*.local",
-    "100.78.182.*",  // VPN/Tailscale subnet (100.78.182.0/24)
-  ],
+  // allowedDevOrigins loaded from environment variable ALLOWED_DEV_ORIGINS
+  // Format: comma-separated list (e.g., "localhost,127.0.0.1,*.local,100.78.182.*")
+  allowedDevOrigins: process.env.ALLOWED_DEV_ORIGINS
+    ? process.env.ALLOWED_DEV_ORIGINS.split(',').map(o => o.trim())
+    : ["localhost", "127.0.0.1", "*.local"],
 };
 
 export default withPWA(nextConfig);

start_server.sh

@@ -75,8 +75,30 @@ echo "🔥 Starting Backend on port $BACKEND_PORT..."
 echo "   CORS origins: $ALLOWED_ORIGINS"
 .venv/bin/python -m uvicorn backend.main:app --host 0.0.0.0 --port $BACKEND_PORT --reload &
 
+# 5. Prepare Frontend Dev Origins from EXTRA_ALLOWED_ORIGINS
+# Convert subnet notation (10.0.0.0/24) to wildcard patterns (10.0.0.*)
+ALLOWED_DEV_ORIGINS="localhost,127.0.0.1,*.local"
+if [ ! -z "$EXTRA_ALLOWED_ORIGINS" ]; then
+    IFS=',' read -ra EXTRA_ADDRS <<< "$EXTRA_ALLOWED_ORIGINS"
+    for addr in "${EXTRA_ADDRS[@]}"; do
+        TRIMMED=$(echo "$addr" | xargs)
+        if [[ "$TRIMMED" == *"/"* ]]; then
+            # Subnet notation: convert 100.78.182.0/24 -> 100.78.182.*
+            SUBNET_PREFIX=$(echo "$TRIMMED" | cut -d'/' -f1)
+            SUBNET_PATTERN="${SUBNET_PREFIX%.*}.*"
+            ALLOWED_DEV_ORIGINS="$ALLOWED_DEV_ORIGINS,$SUBNET_PATTERN"
+        else
+            # Individual IP: add wildcard for nearby IPs (e.g., 192.168.1.100 -> 192.168.1.*)
+            IP_PATTERN="${TRIMMED%.*}.*"
+            ALLOWED_DEV_ORIGINS="$ALLOWED_DEV_ORIGINS,$IP_PATTERN"
+        fi
+    done
+fi
+export ALLOWED_DEV_ORIGINS
+
 # 5. Start Frontend (Next.js)
 echo "💻 Starting Frontend on port $FRONTEND_PORT..."
+echo "   Dev origins: $ALLOWED_DEV_ORIGINS"
 
 # Check Node.js version
 NODE_VERSION=$(node -v | cut -d'v' -f2 | cut -d'.' -f1)
@@ -88,7 +110,7 @@ fi
 cd frontend
 echo "📦 Installing frontend dependencies..."
 npm install
-npm run dev -- -p $FRONTEND_PORT &
+ALLOWED_DEV_ORIGINS="$ALLOWED_DEV_ORIGINS" npm run dev -- -p $FRONTEND_PORT &
 cd ..
 
 # 6. Start Proxies (Crucial for Mobile/Tablet Camera & Sync)