fix(client): allow configurable Vite allowed hosts

Vite >=4.3 rejects requests with a Host header not in the allowlist,
which broke status-page submissions and dev-server access for users
serving Checkmate behind a reverse proxy after upgrading.

Adds VITE_ALLOWED_HOSTS env var (comma-separated list). When unset,
falls back to allowing all hosts so existing self-hosted deployments
keep working without changes.

Closes #3397
Closes #2951

client/package.json

@@ -1,7 +1,7 @@
 {
 	"name": "client",
 	"private": true,
-	"version": "3.6.1",
+	"version": "0.0.0",
 	"type": "module",
 	"scripts": {
 		"dev": "vite",

client/vite.config.ts

@@ -3,19 +3,26 @@ import react from "@vitejs/plugin-react";
 import svgr from "vite-plugin-svgr";
 import path from "path";
 import { fileURLToPath } from "url";
-import { readFileSync } from "fs";
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = path.dirname(__filename);
 
 export default defineConfig(({}) => {
-	const pkg = JSON.parse(readFileSync(path.resolve(__dirname, "package.json"), "utf-8"));
+	let version = "3.6.1";
-	const version = pkg.version;
+
+	const allowedHosts = process.env.VITE_ALLOWED_HOSTS
+		? process.env.VITE_ALLOWED_HOSTS.split(",").map((h) => h.trim())
+		: true;
 
 	return {
 		base: "/",
 		plugins: [svgr(), react()],
 		server: {
 			host: true,
+			allowedHosts,
+		},
+		preview: {
+			host: true,
+			allowedHosts,
 		},
 		resolve: {
 			alias: {