Greptile Summary

Adds optional WebSocket origin allowlist validation via <COIN>_WS_ALLOWED_ORIGINS environment variable with case-insensitive normalization and explicit logging when disabled.

• Origin validation with URL parsing and normalization (scheme + host only)
• Comprehensive test coverage for allowlist parsing and validation logic
• Clear documentation of operator responsibility when allowlist is not configured
• Requests without Origin header bypass check (standard WebSocket behavior for non-browser clients)

_{Last reviewed commit: 261b43c}