fix(tools): restrict CORS origin in Dev UI server

[q1uf3ng]

Summary

The Dev UI server has two security issues:

1. CORS wildcard (server.ts): Access-Control-Allow-Origin: * is hardcoded, allowing any website to make cross-origin requests and read responses.

2. Environment variable disclosure (router.ts): getGenkitEnvironment returns every environment variable without filtering, including GOOGLE_API_KEY, GEMINI_API_KEY, and other secrets.

Combined, any website a developer visits while running genkit start can silently read all their API keys via cross-origin fetch.

Fix

• Restrict CORS origin to http://localhost:{port} (the Dev UI itself)
• Filter environment variables matching sensitive patterns (KEY, SECRET, PASSWORD, TOKEN, CREDENTIAL, PRIVATE) from the response

Reproduction

genkit start
# From any webpage:
# fetch('http://localhost:4000/api/getGenkitEnvironment').then(r=>r.json()).then(console.log)
# Returns all env vars including GOOGLE_API_KEY

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request introduces security enhancements by filtering sensitive environment variables from the Dev UI and restricting CORS origins. Feedback suggests expanding the sensitive pattern list to include 'AUTH' and 'SALT' and improving the CORS origin configuration to support '127.0.0.1' and handle potential port assignment issues.

[MichaelDoyle]

Thanks!