fix: remove stale port 5173 references from board mutation guard

Update dev origin allowlist and tests to use port 3100 only, matching
the unified dev server setup. Fix AGENTS.md and README accordingly.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

server/src/__tests__/board-mutation-guard.test.ts

@@ -46,7 +46,7 @@ describe("boardMutationGuard", () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
-      .set("Origin", "http://localhost:5173")
+      .set("Origin", "http://localhost:3100")
       .send({ ok: true });
     expect(res.status).toBe(204);
   });
@@ -55,7 +55,7 @@ describe("boardMutationGuard", () => {
     const app = createApp("board");
     const res = await request(app)
       .post("/mutate")
-      .set("Referer", "http://localhost:5173/issues/abc")
+      .set("Referer", "http://localhost:3100/issues/abc")
       .send({ ok: true });
     expect(res.status).toBe(204);
   });

server/src/middleware/board-mutation-guard.ts

@@ -2,8 +2,6 @@ import type { Request, RequestHandler } from "express";
 
 const SAFE_METHODS = new Set(["GET", "HEAD", "OPTIONS"]);
 const DEFAULT_DEV_ORIGINS = [
-  "http://localhost:5173",
-  "http://127.0.0.1:5173",
   "http://localhost:3100",
   "http://127.0.0.1:3100",
 ];