Support additional trusted browser origins for self-hosted instances

[salmonumbrella]

Problem

A self-hosted instance can intentionally be reachable through one canonical
public HTTPS origin and additional private-network browser aliases.

EXECUTOR_WEB_BASE_URL needs to remain canonical because it drives OAuth
callbacks, MCP metadata, approval links, and generated URLs. Better Auth
currently trusts only that origin, so browser authentication from an intentional
alias fails. Changing the base URL to an alias would break the canonical outbound
URL contract.

Proposed behavior

Add an optional comma-separated environment variable:

EXECUTOR_TRUSTED_ORIGINS=http://executor.home.arpa:4788,http://192.0.2.10:4788

The canonical base can remain https://executor.example.com.

• Accept exact HTTP and HTTPS origins only.
• Trim, normalize, and deduplicate configured origins.
• Always trust the canonical base origin.
• Fail at startup for invalid configuration.
• Do not infer trusted origins from Host or forwarded-host headers.
• Keep OAuth callbacks and generated URLs on the canonical base origin.

Security

This should be an explicit operator-controlled allowlist, with no wildcards or
request-derived values. Existing single-origin behavior should remain unchanged
when the variable is unset.

Use cases

• NAS and home-server dashboards
• split-horizon DNS
• VPN aliases
• reverse proxies with a canonical public endpoint plus local access