feat(desktop): implement phase 2 native capabilities

backend/app/core/config.py

@@ -26,6 +26,10 @@ class Settings(BaseSettings):
     LOGIN_CHALLENGE_MAX_ACTIVE: int = 1000
     SETTINGS_ENCRYPTION_KEY: Optional[str] = None
     FRONTEND_PUBLIC_URL: str = "http://localhost:8888"
+    CORS_ALLOWED_ORIGINS: str = (
+        "http://localhost:8888,http://localhost:5173,"
+        "tauri://localhost,http://tauri.localhost"
+    )
     IP2REGION_XDB_PATH: Optional[str] = None
     IP2REGION_IPV6_XDB_PATH: Optional[str] = None
 
@@ -36,3 +40,11 @@ def get_settings() -> Settings:
 
 
 settings = get_settings()
+
+
+def get_cors_allowed_origins() -> list[str]:
+    return [
+        origin.strip()
+        for origin in settings.CORS_ALLOWED_ORIGINS.split(",")
+        if origin.strip()
+    ]