aravind changes

go-api/internal/config/config.go

@@ -259,8 +259,13 @@ func (c *Config) validate() error {
 // devCORSOrigins are the origins the Vite dev server can occupy. Vite binds
 // localhost by default and 127.0.0.1 when asked, and a browser treats those two
 // as different origins, so both are listed. 4173 is `vite preview`.
+// 5174 is where Vite lands when 5173 is already taken, which happens whenever a
+// second dev server is started; an origin missing from this list is refused at
+// the preflight with a bare 403 and no CORS headers, which reads as a server
+// fault rather than a misconfigured port.
 var devCORSOrigins = []string{
 	"http://localhost:5173", "http://127.0.0.1:5173",
+	"http://localhost:5174", "http://127.0.0.1:5174",
 	"http://localhost:4173", "http://127.0.0.1:4173",
 }