fix(deploy): 跨域来源未配置时默认放行

start.ps1

@@ -177,9 +177,6 @@ function Setup-EnvFiles {
     $content = Upsert-Env $content "SERVER_HTTP_BIND_IP" $serverBindIp
     # Windows 当前仍使用 Docker Desktop 直连端口；显式覆盖 Linux Nginx 模式的回环默认值。
     $content = Upsert-Env $content "EASYAI_PROXY_BIND_IP" $serverBindIp
-    $webPortMatch = [regex]::Match($content, '(?m)^WEB_PORT=(\d+)$')
-    $webPort = if ($webPortMatch.Success) { $webPortMatch.Groups[1].Value } else { "3010" }
-    $content = Upsert-Env $content "CONFIG_SECURITY_ORIGIN" "http://$($script:DeployIP):$webPort"
     $script:PublicApiBaseUrlCandidate = if ($env:DEPLOY_PUBLIC_API_BASE_URL) {
         $env:DEPLOY_PUBLIC_API_BASE_URL
     } else {
@@ -439,6 +436,7 @@ function Main {
         -Path (Join-Path $script:Root ".env") `
         -Mode $publicUrlMode `
         -Override $script:PublicApiBaseUrlCandidate
+    # CONFIG_SECURITY_ORIGIN is optional. Blank means allow all; explicit values are validated.
     . (Join-Path $script:Root "scripts\Initialize-SecurityOrigin.ps1")
     Initialize-SecurityOrigin -Path (Join-Path $script:Root ".env")