Allow CORS origins in safeRedirect hosts

Local Vite continue URLs use absolute localhost origins that never
pass verified custom-domain checks. Reuse AllowedOrigins so post-auth
redirects work in dev without disabling Validate.

Signed-off-by: Émile Ré <emile@probo.com>

pkg/probod/probod.go

@@ -788,6 +788,7 @@ func (impl *Implm) Run(
 		complianceportal_v1.MuxConfig{
 			BaseURL:           baseURL,
 			ExtraHeaderFields: impl.cfg.Api.ExtraHeaderFields,
+			AllowedOrigins:    impl.cfg.Api.Cors.AllowedOrigins,
 			Logger:            l.Named("compliance-portal"),
 			IAM:               iamService,
 			Visitor:           visitorService,