Fix origin validation for production domains

[kapravel]

Problem: Same-origin requests from production domains (mcp.socket.dev, mcp.socket-staging.dev) were being rejected because browsers don't send an Origin header for same-origin requests, and the validation only allowed missing origins for localhost hosts.
Solution: Extended the Host header validation to also accept production domain hostnames, allowing same-origin requests from production environments to work correctly.

Changes:

• Added allowedHosts derived from allowedOrigins to validate Host headers
• Renamed isLocalhostHost → isAllowedHost to reflect broader scope
• Requests without an Origin header are now allowed if the Host matches localhost OR a production domain

Version bump: 0.0.15 → 0.0.16