fix(gateway): strip Origin header for gateway proxy — CORS 403

The gateway's CORS middleware (api_server.py:557-558) returns 403 for
ANY non-empty Origin header when API_SERVER_CORS_ORIGINS is not
configured. The router was forwarding Origin: http://127.0.0.1:8642 on
all proxied requests (needed for the dashboard's own origin check), but
this caused the gateway to reject every /v1/* and /api/sessions request
with 403 Forbidden — even with a valid Bearer token.

Fix: strip the Origin header (set to empty string) when proxying to the
gateway (port 8642). The gateway treats empty Origin as a non-browser
client and allows it (api_server.py:886-887). The dashboard (port 9119)
still gets the local Origin rewrite it needs.

This fixes the Hermes Android app (and any other API client) getting
'invalid api key' / 403 when connecting through the Space.

health-server.js

@@ -406,7 +406,14 @@ function proxyRequest(
     ...req.headers,
     ...headerOverrides,
     host: `${GATEWAY_HOST}:${targetPort}`,
-    origin: localOrigin,
+    // The dashboard (port 9119) checks Origin against its own bind host and
+    // rejects mismatches, so we rewrite Origin to the local backend. But the
+    // gateway (port 8642) has a CORS middleware that returns 403 for ANY
+    // non-empty Origin when API_SERVER_CORS_ORIGINS is not configured. Since
+    // the router is a reverse proxy (not a browser making a CORS request),
+    // strip Origin for gateway calls so the gateway treats it as a non-browser
+    // client and allows it. headerOverrides can re-add it if needed.
+    origin: targetPort === GATEWAY_PORT ? "" : localOrigin,
     "x-forwarded-host": req.headers.host || "",
     "x-forwarded-proto": req.headers["x-forwarded-proto"] || "https",
   };