refactor: remove all hardcoded IPs/subnets, use environment variables only

- Next.js allowedDevOrigins now loaded from ALLOWED_DEV_ORIGINS env var
- start_server.sh generates ALLOWED_DEV_ORIGINS from EXTRA_ALLOWED_ORIGINS
- Subnet notation (10.0.0.0/24) auto-converts to wildcard patterns (10.0.0.*)
- Individual IPs convert to subnet patterns (192.168.1.100 -> 192.168.1.*)
- Zero hardcoded IPs in source code - all from inventory.env

frontend/next.config.mjs

@@ -10,12 +10,11 @@ const withPWA = withPWAInit({
 /** @type {import('next').NextConfig} */
 const nextConfig = {
   output: "standalone",
-  allowedDevOrigins: [
-    "localhost",
-    "127.0.0.1",
-    "*.local",
-    "100.78.182.*",  // VPN/Tailscale subnet (100.78.182.0/24)
-  ],
+  // allowedDevOrigins loaded from environment variable ALLOWED_DEV_ORIGINS
+  // Format: comma-separated list (e.g., "localhost,127.0.0.1,*.local,100.78.182.*")
+  allowedDevOrigins: process.env.ALLOWED_DEV_ORIGINS
+    ? process.env.ALLOWED_DEV_ORIGINS.split(',').map(o => o.trim())
+    : ["localhost", "127.0.0.1", "*.local"],
 };
 
 export default withPWA(nextConfig);