allowed_origins restricts the browser origins that may call the API.
The default is deliberately permissive: this API authenticates with a
bearer token and never uses cookies, so the Origin header is not a
security boundary — a hardcoded list would only break real deployments
(a tailnet hostname, a phone, a different port) while stopping nothing,
since a non-browser client ignores CORS entirely.