ARCH-2b: permissive LAN CORS + bind API on 0.0.0.0, drop HTTPS redirect

- AddCors lan policy (AllowAnyOrigin/Header/Method) — trusted home LAN, no auth
- Widen ASPNETCORE_URLS host localhost/127.0.0.1 -> 0.0.0.0 (keep Aspire-assigned port)
- Remove dev HTTPS redirection so phones reach the API over plain HTTP

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

GerbilManagerWebAPI/Program.cs

@@ -5,6 +5,18 @@ var builder = WebApplication.CreateBuilder(args);
 
 builder.AddServiceDefaults();
 
+// LAN reachability: bind on all interfaces so devices on the home network (the
+// SPA on a phone/laptop) can reach the API. We keep whatever port Aspire /
+// launchSettings assigned and only widen the host from localhost to 0.0.0.0.
+var aspnetUrls = Environment.GetEnvironmentVariable("ASPNETCORE_URLS");
+if (!string.IsNullOrWhiteSpace(aspnetUrls))
+{
+    var lanUrls = string.Join(';', aspnetUrls
+        .Split(';', StringSplitOptions.RemoveEmptyEntries)
+        .Select(u => u.Replace("localhost", "0.0.0.0").Replace("127.0.0.1", "0.0.0.0")));
+    builder.WebHost.UseUrls(lanUrls);
+}
+
 // Add services to the container.
 
 builder.Services.AddControllers();
@@ -14,6 +26,12 @@ builder.Services.AddSwaggerGen();
 builder.AddNpgsqlDbContext<ApplicationContext>("gerbilmanager");
 builder.Services.AddScoped<UnitOfWork>();
 
+// Permissive CORS for the trusted home LAN (no auth — see hive scope rule).
+// The SPA calls the API cross-origin from other devices on the network.
+const string LanCorsPolicy = "lan";
+builder.Services.AddCors(options => options.AddPolicy(LanCorsPolicy, policy =>
+    policy.AllowAnyOrigin().AllowAnyHeader().AllowAnyMethod()));
+
 var app = builder.Build();
 
 app.MapDefaultEndpoints();
@@ -29,10 +47,10 @@ if (app.Environment.IsDevelopment())
     scope.ServiceProvider.GetRequiredService<ApplicationContext>().Database.Migrate();
 }
 
-if (app.Environment.IsDevelopment())
-{
-    app.UseHttpsRedirection();
-}
+// No HTTPS redirection: the LAN clients (phone) talk plain HTTP to avoid
+// dev-certificate trust issues on the device.
+
+app.UseCors(LanCorsPolicy);
 
 app.UseAuthorization();