fix(android): allow network requests and relax WebView CSP

Enable cleartext HTTP in release APK, add network security config, and set connect-src CSP. Add CORS on Worker API for cross-origin fetches from packaged apps.

Co-authored-by: Cursor <cursoragent@cursor.com>

worker/src/lib/response.ts

@@ -1,3 +1,16 @@
+export function corsHeaders(request: Request): Record<string, string> {
+  const origin = request.headers.get("Origin");
+  if (!origin) return {};
+
+  return {
+    "Access-Control-Allow-Origin": origin,
+    "Access-Control-Allow-Credentials": "true",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization",
+    Vary: "Origin",
+  };
+}
+
 export function jsonResponse(
   data: unknown,
   status = 200,
@@ -12,6 +25,25 @@ export function jsonResponse(
   });
 }
 
+export function jsonResponseWithCors(
+  request: Request,
+  data: unknown,
+  status = 200,
+  headers?: Record<string, string>,
+): Response {
+  return jsonResponse(data, status, {
+    ...corsHeaders(request),
+    ...headers,
+  });
+}
+
+export function corsPreflightResponse(request: Request): Response {
+  return new Response(null, {
+    status: 204,
+    headers: corsHeaders(request),
+  });
+}
+
 export function errorResponse(message: string, status: number): Response {
   return jsonResponse({ error: message }, status);
 }