fix: allow localhost/LAN CORS for SuperAdmin public APIs

Local Vite frontends can call production adm.montzar.ir get_user/get_version without running a local API.

Co-authored-by: Cursor <cursoragent@cursor.com>

src/main.ts

@@ -23,14 +23,20 @@ async function bootstrap() {
 
   const corsOriginRaw = config.get<string>(
     'CORS_ORIGIN',
-    'http://localhost:5173,http://localhost:3100',
+    'http://localhost:5173,http://localhost:5174,http://localhost:3100,http://127.0.0.1:5173,http://127.0.0.1:5174',
   );
   const corsOrigins = corsOriginRaw
     .split(',')
     .map((item) => item.trim())
     .filter(Boolean);
 
-  const isDev = (config.get<string>('NODE_ENV') ?? process.env.NODE_ENV) !== 'production';
+  const isLocalDevOrigin = (origin: string) =>
+    /^http:\/\/(localhost|127\.0\.0\.1)(?::\d+)?$/i.test(origin) ||
+    /^http:\/\/192\.168\.\d{1,3}\.\d{1,3}(?::\d+)?$/i.test(origin) ||
+    /^http:\/\/10\.\d{1,3}\.\d{1,3}\.\d{1,3}(?::\d+)?$/i.test(origin) ||
+    /^http:\/\/172\.(1[6-9]|2\d|3[0-1])\.\d{1,3}\.\d{1,3}(?::\d+)?$/i.test(
+      origin,
+    );
 
   app.enableCors({
     origin: (
@@ -50,13 +56,8 @@ async function bootstrap() {
         callback(null, true);
         return;
       }
-      // Vite روی LAN (مثلاً 172.x / 192.168.x) در توسعه
-      if (
-        isDev &&
-        /^http:\/\/(localhost|127\.0\.0\.1|192\.168\.\d+\.\d+|172\.\d+\.\d+\.\d+|10\.\d+\.\d+\.\d+):\d+$/.test(
-          origin,
-        )
-      ) {
+      // Local / LAN Vite (even against production SuperAdmin) — team local work.
+      if (isLocalDevOrigin(origin)) {
         callback(null, true);
         return;
       }