fix: restore CORS + align frontend with /api/token endpoint

The canonical-architecture rewrite dropped app.use(cors()) and moved the
token route to POST /api/token ({room,identity,name}), but the frontend
still called the old /pods/:id/token — causing "Failed to fetch" in the
browser. Re-add CORS and update fetchPodToken to the new contract.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/server.ts

@@ -1,4 +1,5 @@
 import express from 'express';
+import cors from 'cors';
 import { createServer } from 'node:http';
 import { WebSocketServer } from 'ws';
 import { AccessToken } from 'livekit-server-sdk';
@@ -8,6 +9,7 @@ import { recordOutcome } from './memory/store.js';
 import type { InterventionOutcome } from '@podman/shared';
 
 const app = express();
+app.use(cors());
 app.use(express.json());
 app.get('/health', (_req, res) => res.json({ ok: true }));
 

frontend/src/lib/pod.ts

@@ -8,10 +8,10 @@ export async function fetchPodToken(
   identity: string,
   name: string,
 ): Promise<{ token: string; url: string }> {
-  const res = await fetch(`${BACKEND_URL}/pods/${encodeURIComponent(podId)}/token`, {
+  const res = await fetch(`${BACKEND_URL}/api/token`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ identity, name }),
+    body: JSON.stringify({ room: podId, identity, name }),
   });
   if (!res.ok) throw new Error(`token request failed: ${res.status}`);
   return res.json();