Fix automatic login when boot.dev redirects to www

[wagslane]

Fixes https://github.com/bootdotdev/go-api-gate/issues/10022

• boot.dev/cli/login 301s to www.boot.dev, so the browser sends Origin: https://www.boot.dev. The local login server only accepted the exact frontend_url origin (https://boot.dev, which is persisted in most users' config files), so it 403'd and automatic login silently failed.
• The login server now accepts both the apex and www. variants of the configured frontend host and echoes back the matching origin. Other origins are still rejected.
• Needs a version bump/release to reach users.
• Tested: go test ./..., plus the built binary with a stock config: old build 403s Origin: https://www.boot.dev, new build 200s, https://example.com still 403s.