Use generic regex for CORS instead of hardcoded deployment URLs

Covers both *.hf.space and *.code.run without embedding server-specific
hostnames. Works for HF Spaces and Northflank deployments alike.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

server/app.py

@@ -406,10 +406,8 @@ app.add_middleware(
         "http://localhost:7860",
         "http://localhost:3000",
         "http://localhost:8000",
-        "https://web--jupyter-pytorch--9y6g97v7czb9.code.run",
-        "https://api--jupyter-pytorch--9y6g97v7czb9.code.run",
     ],
-    allow_origin_regex=r"https://.*\.hf\.space|https://.*\.code\.run",
+    allow_origin_regex=r"https://.*\.(hf\.space|code\.run)",
     allow_credentials=True,
     allow_methods=["*"],
     allow_headers=["*"],