[inureyes]

Summary

• /v1/realtime now checks the upgrade's Origin against the --cors-origins / --allowed-origins policy (CorsPolicy::permits_websocket_origin). A disallowed origin gets 403 with {"error":{"message":"origin not allowed for /v1/realtime","type":"invalid_request_error"}} before the upgrade, so no engine reservation is taken. An absent Origin is accepted; the default * policy accepts any origin, so default behavior is unchanged.
• realtime_router takes Arc<CorsPolicy>; build_routes passes the server's policy. The check lives in the route, so router-mode sub-apps (built without the CORS layer) enforce it too. The API-key layer stays outside: failing both checks is 401.
• One sentence in docs/nemotron-voicechat.md next to the --api-key note.

Deviation from the issue

The issue shows the handler taking ws: WebSocketUpgrade. The handler instead takes Result<WebSocketUpgrade, WebSocketUpgradeRejection> as its last extractor, so the origin check runs before upgrade validation. A disallowed origin is refused even on a malformed handshake, and the in-process app test can reach the 403 through create_app / create_app_without_cors without a hyper upgrade handle.

Test plan

• cargo test --release --lib server::cors (new websocket_origin_matrix: every policy against absent, allowed, disallowed, null, non-UTF-8)
• cargo test --release --lib server::routes::realtime (new test over both app builds, including 401 ordering; existing mount/401 test)
• cargo test --release --test realtime_ws (new start_server_with_policy, disallowed_origin_is_rejected_before_session, localhost/default policy test; all existing tests)
• fmt, clippy (--lib --tests --examples -D warnings), contract tests, and cargo test --release -p mlxcel --lib server:: pass locally; GitHub CI not awaited (GB10 runner down)

Closes #2042