fix(cli): widen better-auth trustedOrigins for preview-mode subdomains

Better-auth's CSRF check uses a glob that does not cross dot-separators,
so the default `http://localhost:*` pattern rejected preview hosts of
the form `<commit>--<pidShort>.localhost:<port>`. The browser sign-up
POST to /api/v1/auth/sign-up/email returned 403 with
'[Better Auth]: Invalid origin: http://...localhost:3100'.

The CLI's auto-registered AuthPlugin now builds the trustedOrigins
allow-list explicitly:

  - explicit OS_TRUSTED_ORIGINS (comma-separated) wins
  - the configured baseUrl is always added
  - in OS_PREVIEW_MODE=1, add `http(s)://*.<base>:<*?>` for every
    domain in OS_PREVIEW_BASE_DOMAINS (default
    'preview.objectstack.ai,localhost'); loopback bases use http+:*
  - dev keeps the legacy `http://localhost:*` for non-preview portals

Verified end-to-end: a preview host now serves /_account/setup, the
sign-up POST succeeds, the user is redirected to /_console/home, and
clicking the Enterprise CRM card renders the lead view with the three
sandbox lead records pulled from the per-(project,commit) memory kernel.
No source change is needed in the AuthPlugin, console, or preview stack.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: hotlong

packages/cli/src/commands/serve.ts

@@ -595,10 +595,53 @@ export default class Serve extends Command {
             if (process.env.GITHUB_CLIENT_ID && process.env.GITHUB_CLIENT_SECRET)
               socialProviders.github = { clientId: process.env.GITHUB_CLIENT_ID, clientSecret: process.env.GITHUB_CLIENT_SECRET };
 
+            // Trusted origins (CSRF). better-auth uses a `*` glob that
+            // does NOT cross dot-separators, so `http://localhost:*` does
+            // not cover `http://<sub>.localhost:*`. Build the allow-list
+            // explicitly:
+            //   - explicit `OS_TRUSTED_ORIGINS` (comma-separated) wins
+            //   - else dev / preview defaults below
+            const trustedOrigins: string[] = [];
+            const explicitTrusted = process.env.OS_TRUSTED_ORIGINS?.trim();
+            if (explicitTrusted) {
+              explicitTrusted.split(',').map(s => s.trim()).filter(Boolean).forEach(o => {
+                if (!trustedOrigins.includes(o)) trustedOrigins.push(o);
+              });
+            }
+            // Always add the configured baseUrl so first-party redirects work.
+            try {
+              const u = new URL(baseUrl);
+              const baseOrigin = `${u.protocol}//${u.host}`;
+              if (!trustedOrigins.includes(baseOrigin)) trustedOrigins.push(baseOrigin);
+            } catch { /* ignore malformed baseUrl */ }
+            // Preview-mode subdomain wildcards (`<commit>--<pid>.<base>`).
+            // Honour `OS_PREVIEW_BASE_DOMAINS` (used by service-cloud's
+            // preview routing) and add `http://*.<base>:*` patterns.
+            const previewMode = (process.env.OS_PREVIEW_MODE ?? '').trim().toLowerCase();
+            const isPreviewMode = previewMode === '1' || previewMode === 'true' || previewMode === 'yes';
+            if (isPreviewMode) {
+              const baseDomains = (process.env.OS_PREVIEW_BASE_DOMAINS
+                ?? 'preview.objectstack.ai,localhost')
+                .split(',').map(s => s.trim()).filter(Boolean);
+              for (const dom of baseDomains) {
+                const isLoopback = dom === 'localhost' || dom.endsWith('.localhost');
+                const scheme = isLoopback ? 'http' : 'https';
+                const portSuffix = isLoopback ? ':*' : '';
+                const wildcard = `${scheme}://*.${dom}${portSuffix}`;
+                if (!trustedOrigins.includes(wildcard)) trustedOrigins.push(wildcard);
+              }
+            }
+            // Dev convenience: keep `http://localhost:*` so plain
+            // `localhost:<port>` still works for non-preview Studio/Console.
+            if (isDev && !trustedOrigins.includes('http://localhost:*')) {
+              trustedOrigins.push('http://localhost:*');
+            }
+
             await kernel.use(new AuthPlugin({
               secret,
               baseUrl,
               socialProviders: Object.keys(socialProviders).length > 0 ? socialProviders : undefined,
+              trustedOrigins: trustedOrigins.length ? trustedOrigins : undefined,
             }));
             trackPlugin('Auth');