fix: close the token bypass below a route, review fixes for 4b

The routes matched any path below them, and a web asset name there
passed the token check: GET /backup/a.js returned the backup under
Secured. Every route is now an exact match, and a web asset sits in
the root only.

- e2e: those paths answer 401 or 404; the restore test now fails when
  the chunks skip the token check (checked with the check removed).
- WEB_CORS lets the socket take Origin: null instead of skipping the
  Origin check.
- ADR 0006, GLOSSARY and README: the Origin check in either mode, /ws
  as a public route, the Host header behind a reverse proxy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

platformio.ini

@@ -43,8 +43,8 @@ build_flags =
 	; interleave.  The core already wraps log_printf for ESP Insights.
 	-Wl,--wrap=log_printfv
 	; For work on the web UI from a file:// page (baseUrl in index.js): sends
-	; the CORS headers and lets the socket skip its Origin check.  Never in a
-	; release (docs/SECURITY_PLAN.md, CORS).
+	; the CORS headers and lets the socket take Origin: null, which such a page
+	; sends.  Never in a release (docs/SECURITY_PLAN.md, CORS).
 	; -DWEB_CORS
 monitor_speed = 115200
 monitor_filters =