fix: remove stale port 5173 references from board mutation guard

Update dev origin allowlist and tests to use port 3100 only, matching
the unified dev server setup. Fix AGENTS.md and README accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

AGENTS.md

@@ -40,7 +40,7 @@ pnpm dev
 This starts:
 
 - API: `http://localhost:3100`
-- UI: `http://localhost:5173`
+- UI: `http://localhost:3100` (served by API server in dev middleware mode)
 
 Quick checks:
 
@@ -140,4 +140,3 @@ A change is done when all are true:
 2. Typecheck, tests, and build pass
 3. Contracts are synced across db/shared/server/ui
 4. Docs updated when behavior or commands change
-

README.md

@@ -218,7 +218,6 @@ By default, agents run on scheduled heartbeats and event-based triggers (task as
 ```bash
 pnpm dev              # Full dev (API + UI)
 pnpm dev:server       # Server only
-pnpm dev:ui           # UI only
 pnpm build            # Build all
 pnpm typecheck        # Type checking
 pnpm test:run         # Run tests

server/src/__tests__/board-mutation-guard.test.ts

@@ -46,7 +46,7 @@ describe("boardMutationGuard", () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
-      .set("Origin", "http://localhost:5173")
+      .set("Origin", "http://localhost:3100")
       .send({ ok: true });
     expect(res.status).toBe(204);
   });
@@ -55,7 +55,7 @@ describe("boardMutationGuard", () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
-      .set("Referer", "http://localhost:5173/issues/abc")
+      .set("Referer", "http://localhost:3100/issues/abc")
       .send({ ok: true });
     expect(res.status).toBe(204);
   });

server/src/middleware/board-mutation-guard.ts

@@ -2,8 +2,6 @@ import type { Request, RequestHandler } from "express";
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 const DEFAULT_DEV_ORIGINS = [
-  "http://localhost:5173",
-  "http://127.0.0.1:5173",
   "http://localhost:3100",
   "http://127.0.0.1:3100",
 ];