feat(loopover): flip PUBLIC_API_ORIGIN to api.loopover.ai

[JSONbored]

Closes #4765. Completes the domain flip started in the earlier
PUBLIC_SITE_ORIGIN change: this was deliberately deferred pending
confirmation that the GitHub OAuth callback URL was updated on
GitHub's side, since flipping this changes the redirect_uri sent
during login.

Confirmed and executed: the classic OAuth App behind
GITHUB_OAUTH_CLIENT_ID (used for dashboard web login and the MCP
CLI's device-flow login) only supports a single registered callback
URL (unlike a GitHub App's up-to-10), so this had to be a hard
cutover -- the OAuth App's callback URL was updated directly to
https://api.loopover.ai/v1/auth/github/callback on GitHub's side in
lockstep with this change.

The old gittensory-api.aethereal.dev domain stays live and routed to
the same Worker (both routes already present in wrangler.jsonc's
routes array from the earlier Step 1 domain-wiring work) and stays in
the CORS allowlist -- added it to DEFAULT_CORS_ORIGINS statically,
since PUBLIC_API_ORIGIN's dynamic CORS addition now only covers the
new domain. No redirect, no sunset date; only which domain this
instance treats as canonical for outbound URL construction
(redirect_uri, ORB_BROKER_URL default, etc.) has flipped.

Test plan

• Full local gate (npm run test:ci + npm audit --audit-level=moderate) green.
• Fixed the one real assertion depending on the old default: the
  redirect_uri built during startGitHubWebOAuth in
  test/unit/auth.test.ts (env.PUBLIC_API_ORIGIN always wins over the
  requestUrl argument passed to that function, so every other
  gittensory-api.aethereal.dev mention in that file is arbitrary
  fixture input, unaffected).
• Fixed a CORS preflight test that exercised exactly the static-list
  gap this PR closes.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 95.01%. Comparing base (8106063) to head (92982a2).
⚠️ Report is 1 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5618   +/-   ##
=======================================
  Coverage   95.01%   95.01%           
=======================================
  Files         574      574           
  Lines       45684    45684           
  Branches    14661    14661           
=======================================
  Hits        43405    43405           
  Misses       1528     1528           
  Partials      751      751           

Flag	Coverage Δ
shard-1	43.99% <ø> (ø)
shard-2	36.15% <ø> (+0.42%)	⬆️
shard-3	32.09% <ø> (-0.16%)	⬇️
shard-4	32.61% <ø> (-0.01%)	⬇️
shard-5	31.75% <ø> (ø)
shard-6	44.07% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
src/api/routes.ts	94.30% <ø> (ø)

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.