chore(dev): allow tunnel host + all interfaces in Vite dev server

Reaching the dev PWA through the Pangolin/newt tunnel failed: Vite's default
host check 403s any non-localhost Host header ('Blocked request'), which the
tunnel health checks on / and /health read as unhealthy. Add allowedHosts:true
and host:true so the dev server accepts the tunnel hostname and listens on all
interfaces. Dev-only config; the production image serves the built PWA itself.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

apps/pwa/vite.config.ts

@@ -44,6 +44,13 @@ export default defineConfig({
     }),
   ],
   server: {
+    // Dev box reached through the Pangolin/newt tunnel: Vite's default host check
+    // 403s any non-localhost Host header ("Blocked request"), which the tunnel
+    // health check reads as unhealthy. `true` accepts any host (fine for a private
+    // throwaway dev tunnel); replace with e.g. ['familysync.example.com'] to scope it.
+    allowedHosts: true,
+    // Listen on all interfaces so newt can reach Vite via the box IP, not just localhost.
+    host: true,
     proxy: {
       '/health': 'http://localhost:3000',
       '/api': 'http://localhost:3000',