feat(selfhost): allow additional trusted browser origins

[salmonumbrella]

Closes #1440

Summary

• add a validated EXECUTOR_TRUSTED_ORIGINS allowlist for self-hosted browser aliases
• keep EXECUTOR_WEB_BASE_URL canonical for OAuth callbacks and generated URLs
• improve invalid-origin guidance and document the new setting

Security

• accepts exact, explicit HTTP and HTTPS origins only
• rejects credentials, paths, queries, fragments, wildcards, and other schemes
• never infers trusted origins from request headers
• preserves the existing single-origin default when unset

Verification

• bun run format
• bun run format:check
• bun run lint
• bun run typecheck
• bun run --cwd apps/host-selfhost test (18 files, 80 tests)

[salmonumbrella]

Some context on why the mixed-protocol example (https canonical + http trusted origins) is the headline use case: umbrelOS — and home servers like it — serve local access (umbrel.local, LAN IP) over plain HTTP only. HTTPS for local access has been an open umbrelOS request since 2021 (getumbrel/umbrel#546), while remote access via Tailscale is HTTPS. So a self-hosted instance on that class of host unavoidably spans one https origin plus http local aliases, and a single canonical EXECUTOR_WEB_BASE_URL can't cover them.