feat(dev-server): support allowedHosts (Codespaces / ngrok / *.localhost) (#144)

[lukekania]

Closes #144.

Summary

Honor the allowedHosts array on the dev-server builder so projects running behind tunneling proxies (ngrok, Cloudflare Tunnel, GitHub Codespaces) or non-default local hostnames (*.localhost, app.local) don't get rejected by the dev server's Host:-header check.

• packages/builder/schemas/dev-server.json — new allowedHosts: { type: array, items: { type: string } } property.
• packages/builder/src/serve/options.ts — forwards the list to ngc-rs serve as --allowed-hosts host1,host2, normalizing empty/whitespace entries and deduping case-insensitively on the way out.
• crates/cli/src/main.rs + serve_cmd.rs — new --allowed-hosts flag with a comma value delimiter, threaded through run / run_with_stop and into DevServerConfig::with_allowed_hosts.
• crates/dev-server/src/lib.rs — new AllowedHosts resolver + filter in handle_request. Loopback (localhost, 127.0.0.1, [::1]) is always accepted. The literal "all" disables the check entirely; "auto" (or an empty list, the default) additionally accepts the bound host. Anything else is an exact, case-insensitive hostname match with the Host: port stripped before comparison. Mismatches return 403 with a body that names the offending host and points at both architect.serve.options.allowedHosts and the CLI flag.

Bumps [workspace.package].version to 0.10.12.

Definition of done

• "allowedHosts": ["my-app.ngrok.io"] lets ngrok-tunneled traffic through — covered by explicit_allowed_host_lets_ngrok_traffic_through in crates/dev-server/tests/integration.rs.
• "allowedHosts": ["all"] disables the check entirely — covered by allowed_hosts_all_disables_check.
• A request to a non-allowed host gets a 403 with a clear error body — covered by default_allowed_hosts_accept_loopback_and_403_others, which also asserts the body mentions the host and allowedHosts.

Test plan

• cargo build --release -p ngc-rs
• cargo test -p ngc-dev-server (21 tests pass, incl. 3 new integration tests + 9 new unit tests)
• cargo test -p ngc-rs --tests (all pre-existing tests pass; serve_help_lists_all_flags updated to assert --allowed-hosts is listed)
• cargo clippy --workspace -- -D warnings
• npm test in packages/builder (69 tests pass, incl. 4 new translateOptions cases for allowedHosts)

[lukekania]

Closing to recreate the PR with the closing-keyword reference present at open time so GitHub auto-links #144. The branch is unchanged; commits and review history not needed yet.