Fix board viewer origin checks for Symphony mutations

[cursor]

Summary

• Apply the existing local-origin mutation guard to board-viewer Symphony proxy POST routes (refresh, pause, resume).
• Add an HTTP-level regression test proving forbidden-origin POSTs are rejected before any upstream Symphony request is made.

Type

• Bug fix
• Feature
• Docs
• Tests or tooling
• Refactor

Verification

/tmp/symphony-venv/bin/python -m pytest tests/test_board_viewer.py -q
# 13 passed in 0.64s

/tmp/symphony-venv/bin/python -m pytest -q
# 539 passed, 5 skipped in 25.80s

For workflow/service/board changes:

/tmp/symphony-venv/bin/symphony doctor ./WORKFLOW.md
# FAIL: 'claude' not on $PATH in this container
# FAIL: /workspace/kanban does not exist in this checkout
# Other checks passed

Risk Notes

• Low implementation risk: mirrors the origin check already used by branch-policy, settings, and archive mutations.
• Existing same-origin browser UI calls still work; requests without an Origin header remain allowed for non-browser/local clients per existing policy.

Checklist

• This PR targets dev.
• I added or updated tests for behavior changes.
• I updated docs/examples for user-facing changes.
• I did not commit secrets, logs, local run state, virtualenvs, or generated artifacts.
• CI is green or I explained any expected failure above.