fix: honor IDE allowed origins for IDE routes

[haosenwang1018]

Summary

• wire OM_IDE_ALLOWED_ORIGINS into the server CORS handling for /api/ide/* routes
• return the requesting origin for IDE requests when OM_IDE_MODE=true and the origin is explicitly allowlisted
• keep the existing permissive fallback for non-IDE routes

Why

Issue #123 reports that OpenMemory does not work with Claude in Antigravity.

While tracing the IDE/MCP integration path, I found that:

• OM_IDE_MODE and OM_IDE_ALLOWED_ORIGINS are defined in config
• but ide_allowed_origins was never actually consumed by the server
• all routes always returned Access-Control-Allow-Origin: *

This patch makes the IDE-specific allowlist configuration live for /api/ide/* requests instead of leaving it as a dead config knob.

Testing

• cd packages/openmemory-js && npm run build

Related to #123