chore: add AGENTS.md, extract ALLOWED_ORIGINS, wire e2e config, add inline comments

[liorsbg]

What

Adds agent guidance and applies four code improvements identified during an AGENTS.md audit.

Changes

New files

• AGENTS.md — agent guidance covering architecture decisions, testing conventions, code style rules, boardgame.io import paths, and a "do not do" list. Includes non-obvious constraints like the p-queue footgun, the intentional RemoteStorage.listMatches [] return, and the dual ALLOWED_ORIGINS arrays.
• AGENTS-IMPROVEMENT-SPEC.md — audit record: what was good, what was missing, what was wrong, and the prioritised list of remaining work.

Code changes

• src/cors.ts — new shared ALLOWED_ORIGINS constant. Removes the duplicate definitions that existed independently in server.ts and lobby.ts.
• src/remote-storage.ts — comment on listMatches explaining the intentional [] return (lobby DO owns the match list).
• src/match-room.ts — comment on SimpleQueue explaining why p-queue cannot be used in the Miniflare Workers environment.
• package.json — pnpm e2e:local now runs vitest run --config vitest.e2e.config.ts instead of the legacy curl-based scripts/e2e-local.mjs. The E2E test files already manage the dev server lifecycle internally.

Verification

pnpm typecheck  # clean
pnpm lint       # 0 errors, 57 pre-existing any warnings (unchanged)
pnpm test       # 93/93 passed