[FuTseYi]

Changes

• Replace Flask-SocketIO's wildcard cors_allowed_origins="*" with explicit loopback Vite origins (localhost:8100, 127.0.0.1:8100).
• Add dependency-free policy regression tests and local-websocket guidance.

Limits

• This is defense-in-depth for the local-only development demo, not authentication or authorization.
• Browser origins from a different host/port will be rejected; do not expose this service to a LAN or public network until a real access-control design is implemented.
• Normal Vue/Spring Boot builds and Python regression tests should all pass before merging.