sentry: hash-prefixed *.pages.dev aliases don't match allowUrls/tracePropagationTargets

Follow-ups from Opus 5 review of PR #355 (all non-blocking, APPROVE):

1. Hash-prefixed Pages aliases don't match the origin strings. Cloudflare gives every deployment a permanent https://<hash>.comapeo-cloud-app.pages.dev URL; builds there DO have the DSN, but "https://abc.comapeo-cloud-app.pages.dev".includes("https://comapeo-cloud-app.pages.dev") is false, so events/trace headers are dropped. Pre-existing for allowUrls; PR #355 propagates it to tracePropagationTargets. Shared fix: make resolveOrigins() return (string | RegExp)[] and emit /^https:\/\/([a-z0-9-]+\.)?comapeo-cloud-app\.pages\.dev/.

2. resolveAllowUrls() null branch is dead code. PAGES_DEV_ORIGIN is a hardcoded non-empty constant, so origins.length > 0 is always true; the ...(allowUrls ? {allowUrls} : {}) false branch and its comment are unreachable. Clean up.

3. VITE_CF_PAGES_ORIGIN is tested but set nowhere in CI or .env.example — either wire it up or document it.

When the comapeo-cloud API origin is eventually added to tracePropagationTargets, the server must return sentry-trace, baggage in Access-Control-Allow-Headers (preflight otherwise blocks the requests).

Start by locating resolveOrigins(), resolveAllowUrls(), and the VITE_CF_PAGES_ORIGIN references, then review the changes from PR #355. Confirm hash-prefixed Pages aliases match both URL controls, remove the unreachable null branch, and either wire up or document the environment variable. Also preserve the stated CORS header requirement for future API trace propagation.