A dev server proxy instead of CORS in development

Adding permissive CORS headers so a dev server on 5173 can reach an API on 8080 means the development configuration differs from production in a security-relevant way.

// vite.config.js
export default {
  server: {
    proxy: {
      '/api': {
        target: 'http://localhost:8080',
        changeOrigin: true,
      },
    },
  },
}

// the browser now sees one origin, which is what it sees
// in production. no CORS headers anywhere.

The proxy makes development match production in the one respect that matters — same-origin requests — and removes a permissive header that somebody will eventually ship. The failure mode it introduces is that a genuine cross-origin problem is invisible until deployment, which is a fair trade when the production setup is same-origin and a bad one when it is not.