fix(api): unify browser and signaling origin allowlists

[vitorhugo-dotnet]

Root cause

The deployed API had two independent browser-origin allowlists. General browser CORS used Cors:AllowedOrigins with the production frontend as its default, while the signaling grant preflight and cookie-authenticated WebSocket used Signaling:AllowedWebOrigins, which was empty in production. The result was a successful deployment that still emitted no credentialed CORS headers and rejected the cookie WebSocket origin.

Fix

• use WebClientCorsOptions.EffectiveAllowedOrigins for the signaling grant CORS policy
• use the same allowlist for cookie-authenticated WebSocket origin validation
• remove the redundant empty SignalingOriginOptions
• update integration tests to reproduce the production configuration

Verification

• dotnet test tests/SonicRelay.Api.IntegrationTests --filter "FullyQualifiedName~CorsTests|FullyQualifiedName~SignalingGrantEndpointsTests|FullyQualifiedName~SignalingGrantServiceTests|FullyQualifiedName~SignalingWebSocketTests" --no-restore — 52 passed
• git diff --check

Follow-up to #55 and vitorhugo-dotnet/flutter_mobile-web_SonicRelay#57