Disable SvelteKit CSRF origin check for multipart uploads

SvelteKit's built-in cross-site POST guard was blocking legitimate
multipart uploads from our own UI (HTTP 403 'Cross-site POST form
submissions are forbidden') whenever the operator reaches the app via
a hostname/port that doesn't match the browser's Origin header — LAN
IPs, reverse proxies, and .local hostnames all trip it. This tool is
scoped to private networks and has no cross-origin surface to defend
against, so the guard is more friction than protection here.

If Electric Cherry ever gets exposed to the public internet, do
per-route origin checks in hooks.server.ts instead of re-enabling
this blanket rule.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

svelte.config.js

@@ -9,6 +9,18 @@ const config = {
         alias: {
             $ui: 'src/lib/ui',
             '$ui/*': 'src/lib/ui/*'
+        },
+        // Electric Cherry is a private-network fleet manager reached via
+        // whatever hostname/port the operator's proxy exposes it on. Origin
+        // headers get rewritten en route (reverse proxies, LAN IPs, .local
+        // hostnames), so SvelteKit's default cross-site POST guard blocks
+        // legitimate multipart uploads from our own UI. There is no
+        // cross-origin surface to defend against here — the app only accepts
+        // traffic from inside the LAN — so turn the guard off. If this ever
+        // gets exposed to the public internet, add per-route origin checks in
+        // hooks.server.ts instead of re-enabling this blanket rule.
+        csrf: {
+            checkOrigin: false
         }
     }
 };