Fix WebSocket 403 in dev mode by allowing localhost origins

The CheckOrigin function only accepted the production domain, rejecting
localhost connections in dev. Also removed redundant error response after
a failed upgrade since the upgrader already writes its own HTTP response.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

backend/services/websocket.go

@@ -26,7 +26,9 @@ var Upgrader = websocket.Upgrader{
 		}
 		origin = strings.TrimPrefix(origin, "https://")
 		origin = strings.TrimPrefix(origin, "http://")
-		return origin == allowedDomain || origin == "www."+allowedDomain
+		// Strip port for localhost comparisons (e.g. "localhost:80")
+		host := strings.Split(origin, ":")[0]
+		return origin == allowedDomain || origin == "www."+allowedDomain || host == "localhost"
 	},
 }