refactor(transform): URL-pass pattern — bridge fetches source, not browser

feat(local-bridge): POST /transform — SA3 audio-to-audio via init-audio

Bridge: widen Access-Control-Allow-Headers to 'Content-Type, content-type'

Local bridge: handle Chrome PNA preflight; drop bad mixed-content guard

Local SA3 bridge: wire run_mlx_sa3 to ~/sa3_mlx/sa3 with verified CLI

Initial deploy