Same-origin reverse proxy removes browser CORS for the web build; upstream
named per-request via X-Honcho-Upstream header (frontend stays source of
truth). Tauri keeps reqwest-absolute. Optional SSRF allowlist, open by
default. Preserves existing Fleet aggregation; new aggregation deferred.
