feat: add subnet-based CORS validation support for VPN/Tailscale origins

- Add ipaddress module for subnet parsing (10.0.0.0/24 format)
- Implement subnet validation in CORS middleware
- Separate individual IPs from subnet definitions in EXTRA_ALLOWED_ORIGINS
- Custom SubnetAwareCORSMiddleware for dynamic origin validation
- Support both exact IP matches and subnet ranges
- Backward compatible with existing ALLOWED_ORIGINS list

start_server.sh

@@ -39,6 +39,18 @@ echo "📦 Updating Python dependencies..."
 # 4. Get Local IP and set environment variables
 LOCAL_IP=$(hostname -I | awk '{print $1}' || echo "localhost")
 export ALLOWED_ORIGINS="http://localhost:$FRONTEND_PORT,http://localhost:$BACKEND_PORT,https://localhost:$FRONTEND_SSL_PORT,https://localhost:$BACKEND_SSL_PORT,https://$LOCAL_IP:$FRONTEND_SSL_PORT,https://$LOCAL_IP:$BACKEND_SSL_PORT"
+
+# 4.0 Include EXTRA_ALLOWED_ORIGINS from inventory.env (VPN, Tailscale, etc.)
+if [ ! -z "$EXTRA_ALLOWED_ORIGINS" ]; then
+    echo "🔌 Adding extra CORS origins from inventory.env..."
+    IFS=',' read -ra EXTRA_ADDRS <<< "$EXTRA_ALLOWED_ORIGINS"
+    for addr in "${EXTRA_ADDRS[@]}"; do
+        TRIMMED=$(echo "$addr" | xargs)
+        # Add both HTTP (for localhost dev) and HTTPS (for production)
+        export ALLOWED_ORIGINS="$ALLOWED_ORIGINS,http://$TRIMMED:$FRONTEND_PORT,http://$TRIMMED:$BACKEND_PORT,https://$TRIMMED:$FRONTEND_SSL_PORT,https://$TRIMMED:$BACKEND_SSL_PORT"
+    done
+fi
+
 export JWT_SECRET_KEY="${JWT_SECRET_KEY:-ephemeral-dev-key-$(date +%s)}"
 export DATA_DIR="$(cd "$(dirname "$0")" && pwd)/data"
 export LOGS_DIR="$(cd "$(dirname "$0")" && pwd)/logs"