fix: restore CORS + align frontend with /api/token endpoint

The canonical-architecture rewrite dropped app.use(cors()) and moved the
token route to POST /api/token ({room,identity,name}), but the frontend
still called the old /pods/:id/token — causing "Failed to fetch" in the
browser. Re-add CORS and update fetchPodToken to the new contract.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

frontend/src/lib/pod.ts

@@ -8,10 +8,10 @@ export async function fetchPodToken(
   identity: string,
   name: string,
 ): Promise<{ token: string; url: string }> {
-  const res = await fetch(`${BACKEND_URL}/pods/${encodeURIComponent(podId)}/token`, {
+  const res = await fetch(`${BACKEND_URL}/api/token`, {
     method: 'POST',
     headers: { 'content-type': 'application/json' },
-    body: JSON.stringify({ identity, name }),
+    body: JSON.stringify({ room: podId, identity, name }),
   });
   if (!res.ok) throw new Error(`token request failed: ${res.status}`);
   return res.json();