Include community PRs: CORS restriction, language passthrough, model size fix, TS/mediaDevices guards

[Copilot]

Applies five open community PRs from jamiepine/voicebox (jamiepine#78, jamiepine#88, jamiepine#91, jamiepine#95, jamiepine#97).

Backend

• CORS hardening (security: restrict CORS to known local origins jamiepine/voicebox#88): Replace allow_origins=["*"] with an explicit allowlist (localhost:5173, localhost:17493, tauri://localhost, https://tauri.localhost). Extended via VOICEBOX_CORS_ORIGINS env var (comma-separated).
• Language passthrough to TTS (fix: pass language parameter to TTS models jamiepine/voicebox#97): Both PyTorch and MLX backends were silently dropping the language param. Adds LANGUAGE_CODE_TO_NAME mapping (ISO 639-1 → full name) and passes it to generate_voice_clone() / model.generate(lang_code=).
• Model size selection fix (Fix: selecting 0.6B model still downloads and uses 1.7B jamiepine/voicebox#95): create_voice_prompt_for_profile() was called before load_model_async(model_size), causing it to fall back to 1.7B internally. Reordered so the correct model is loaded first.

Frontend

• Language auto-sync (fix: pass language parameter to TTS models jamiepine/voicebox#97): FloatingGenerateBox now syncs the language dropdown to the selected profile's language via useEffect.
• navigator.mediaDevices guard (fix: guard getUserMedia call against undefined mediaDevices in non-secure contexts jamiepine/voicebox#78): Prevents crash when component mounts in an insecure context or non-browser environment.
• Garbled useEffect dep array (fix: CoreAudio device enumeration, input device visibility, AudioTab UX jamiepine/voicebox#91): [platform.metadata.isTauricheckOnMountcheckForUpdates] → [platform.metadata.isTauri, checkOnMount, checkForUpdates].
• Stale @ts-expect-error (fix: CoreAudio device enumeration, input device visibility, AudioTab UX jamiepine/voicebox#91): Removed three suppression comments in App.tsx; __voiceboxServerStartedByApp is already declared in global.d.ts.
• Wrong mouse event type (fix: CoreAudio device enumeration, input device visibility, AudioTab UX jamiepine/voicebox#91): StoryTrackEditor handleTimelineClick typed as MouseEvent<HTMLDivElement> → MouseEvent<HTMLElement>.

Tests

• Added backend/tests/test_cors.py (security: restrict CORS to known local origins jamiepine/voicebox#88): validates allowed/blocked origins and VOICEBOX_CORS_ORIGINS parsing edge cases against a minimal FastAPI mirror of the CORS config.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.