feat: remote access via Tailscale using [server].trusted_origins

[hkrathore]

Summary

Adds a [server].trusted_origins config (settable in config.local.toml) that lets users allow additional HTTPS origins past the same-origin check without binding the server to 0.0.0.0. This enables remote access from a phone or another device via Tailscale while keeping the project's localhost-only security model intact.

Motivation

I wanted to reach agentchattr from my phone while it keeps running on my Mac mini / Oracle VPS. --allow-network exposes the server over unencrypted HTTP on the LAN, which the README already warns against. Tailscale provides a private HTTPS entrypoint that's a much better fit, but the existing origin check rejects anything but http://127.0.0.1:PORT / http://localhost:PORT.

What changed

• config.toml — document the new [server].trusted_origins key (default [], so no behavior change for existing users)
• config.local.toml.example — show how to set it to a tailnet hostname
• config_loader.py — merge [server].trusted_origins from config.local.toml into the effective config, dedupe while preserving order
• app.py — extract _build_allowed_origins(cfg) which combines the existing localhost defaults with trusted_origins; SecurityMiddleware uses the merged set, logic otherwise unchanged
• README.md — full Tailscale remote-access guide under the existing "Network mode" section: install, config, tailscale serve, security notes

Design notes

• Host still binds 127.0.0.1. The browser reaches the app via Tailscale Serve's reverse proxy; the app sees the Origin header from the tailnet hostname and allows it because it's in the whitelist.
• Only exact HTTPS origin strings are matched. No wildcards, no scheme inference.
• Empty trusted_origins = no change from current behavior.

Test plan

• All existing tests pass: pytest tests/ → 42 passed
• Unit test: trusted_origins in config.local.toml flows through load_config → _build_allowed_origins, with dedup
• End-to-end against a running instance:
  • Trusted tailnet Origin → passes origin check, proceeds to token check
  • Attacker Origin (evil.example.com) → 403 {"error":"forbidden: origin not allowed"}
  • No Origin header → passes origin check (unchanged behavior)
• Docs render: Tailscale section fits under existing network/security section