Lock down CORS and add rate limiting on the chat endpoints

[n33levo]

What this fixes

This follows the IDOR fix in #67 and closes the cross-origin / brute-force pieces called out in Shopify/consumer-agent#1826.

What changed

• CORS no longer reflects arbitrary origins. Only origins in ALLOWED_ORIGINS are echoed back; localhost browser clients are allowed in development.
• CORS responses that echo an origin now include Vary: Origin.
• .env.example now calls out that Shopify storefront origins are required in every environment.
• Added a small in-memory rate limiter to chat, history, and token-status requests.
• Rate-limit buckets are scoped per endpoint, use the rightmost forwarded IP instead of client-supplied shop IDs, and do not collapse requests without X-Forwarded-For into a shared unknown bucket.
• Expired-bucket sweeps are throttled so high-cardinality traffic does not force a full map scan on every request.
• Chat rate-limit responses and all other pre-stream chat failures now return JSON headers instead of advertising text/event-stream for JSON bodies.
• The widget checks non-OK chat responses before reading the body as SSE, so HTTP 429 responses surface as a busy message instead of being parsed as stream frames.
• Token-status now uses the same conversation/shop validation before checking CustomerToken, so it no longer answers questions about raw conversation_id values.
• The widget sends X-Shopify-Shop-Id when polling token status.
• Added Node tests for CORS, rate-limit behavior, JSON response contracts, and Vite-backed route behavior.

Stack

1. Make conversation IDs unguessable and scope chats to their shop #67 — unguessable conversation IDs + shop-scoped conversation access.
2. This PR — CORS lockdown, rate limiting, and token-status hardening.

Verification

• node --test — 28 passing, 5 Vite-backed route tests skipped locally because dependencies are not installed in this checkout.
• Syntax-checked touched JS/JSX/test files with node --check.
• git diff --check.

[marcelobarreto]

---

Review assisted by pair-review

[n33levo]

Follow-up audit after re-reading the stack end-to-end: I pushed 92f86f5 on top of the refreshed #67.

The extra #68 fix is in the widget: it now checks non-OK chat responses before reading the response body as SSE, so HTTP 429 JSON responses surface as the busy message instead of being parsed as stream frames.

Re-verified top of stack: node --test 18/18, git diff --check, syntax checks on touched JS/JSX/test files, plus a grep audit for the risky patterns Marcelo called out.

[n33levo]

---

Review assisted by pair-review

[n33levo]

---

Review assisted by pair-review