fix(client): allow configurable Vite allowed hosts

Vite >=4.3 rejects requests with a Host header not in the allowlist,
which broke status-page submissions and dev-server access for users
serving Checkmate behind a reverse proxy after upgrading.

Adds VITE_ALLOWED_HOSTS env var (comma-separated list). When unset,
falls back to allowing all hosts so existing self-hosted deployments
keep working without changes.

Closes #3397
Closes #2951

client/vite.config.ts

@@ -9,11 +9,20 @@ const __dirname = path.dirname(__filename);
 export default defineConfig(({}) => {
 	let version = "3.6.1";
 
+	const allowedHosts = process.env.VITE_ALLOWED_HOSTS
+		? process.env.VITE_ALLOWED_HOSTS.split(",").map((h) => h.trim())
+		: true;
+
 	return {
 		base: "/",
 		plugins: [svgr(), react()],
 		server: {
 			host: true,
+			allowedHosts,
+		},
+		preview: {
+			host: true,
+			allowedHosts,
 		},
 		resolve: {
 			alias: {