fix(server): apply the Host check before the app's own routes

Vite installs its Host check after the middleware plugins add in
configureServer, so the provider and /api routes answered any Host,
including a DNS-rebinding name. hostCheckPlugin runs first on the dev and
preview servers and applies Vite's rule with the same allowed hosts: IP
addresses, localhost and *.localhost, the configured server host, and the
listed names. A test drives a real Vite server with an unlisted Host.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

build/vite.js

@@ -1,6 +1,6 @@
 import { applicationHtmlPlugin } from './application-html.js';
 import cesium from 'vite-plugin-cesium';
-import { DEFAULT_ALLOWED_HOSTS } from './allowedHosts.js';
+import { DEFAULT_ALLOWED_HOSTS, hostCheckPlugin } from './allowedHosts.js';
 import { embedFramingPlugin } from './embed-framing.js';
 import { panelBuildPlugin } from './panel.js';
 
@@ -53,6 +53,8 @@ export function createBrowserViteConfig({
 } = {}) {
   return {
     plugins: [
+      // First, so no provider route answers a Host the server does not allow.
+      hostCheckPlugin(),
       cesium(),
       applicationHtmlPlugin(),
       ...plugins,