fix(mini): preserve taskbar and restore login

backend/internal/config/config_test.go

@@ -23,6 +23,8 @@ func TestDevelopmentConfigMatchesLocalWorkspaceContract(t *testing.T) {
 	require.ElementsMatch(t, []string{
 		"http://localhost:5173",
 		"http://127.0.0.1:5173",
+		"http://localhost:5180",
+		"http://127.0.0.1:5180",
 		"http://localhost:4173",
 		"http://127.0.0.1:4173",
 		"http://localhost:4174",

backend/internal/httpx/router.go

@@ -56,6 +56,8 @@ func cors(cfg config.Config) gin.HandlerFunc {
 		origins = []string{
 			"http://localhost:5173",
 			"http://127.0.0.1:5173",
+			"http://localhost:5180",
+			"http://127.0.0.1:5180",
 			"http://tauri.localhost",
 		}
 	}

backend/internal/httpx/router_test.go

@@ -81,6 +81,18 @@ func TestRouterAddsCORSHeadersForLocalWebClient(t *testing.T) {
 	require.Contains(t, rec.Header().Get("Access-Control-Allow-Headers"), "Authorization")
 }
 
+func TestRouterAddsCORSHeadersForMiniClient(t *testing.T) {
+	router := NewRouter(config.Config{Env: "test"}, testRegistrar{})
+	req := httptest.NewRequest(http.MethodGet, "/api/v1/ping", nil)
+	req.Header.Set("Origin", "http://localhost:5180")
+	rec := httptest.NewRecorder()
+
+	router.ServeHTTP(rec, req)
+
+	require.Equal(t, http.StatusOK, rec.Code)
+	require.Equal(t, "http://localhost:5180", rec.Header().Get("Access-Control-Allow-Origin"))
+}
+
 func TestAPIV1LoginRemainsPublic(t *testing.T) {
 	router := NewProtectedRouter(config.Config{Env: "test"}, func(token string) (uint, error) {
 		return 0, http.ErrNoCookie