fix: restore CORS + align frontend with /api/token endpoint

The canonical-architecture rewrite dropped app.use(cors()) and moved the
token route to POST /api/token ({room,identity,name}), but the frontend
still called the old /pods/:id/token — causing "Failed to fetch" in the
browser. Re-add CORS and update fetchPodToken to the new contract.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

backend/src/server.ts

@@ -1,4 +1,5 @@
 import express from 'express';
+import cors from 'cors';
 import { createServer } from 'node:http';
 import { WebSocketServer } from 'ws';
 import { AccessToken } from 'livekit-server-sdk';
@@ -8,6 +9,7 @@ import { recordOutcome } from './memory/store.js';
 import type { InterventionOutcome } from '@podman/shared';
 
 const app = express();
+app.use(cors());
 app.use(express.json());
 app.get('/health', (_req, res) => res.json({ ok: true }));