[Security] CORS Wildcard on Local API Server Enables Cross-Origin Abuse

server.cpp line 614 hardcodes Access-Control-Allow-Origin: * on every response. Combined with no API key auth (only serverChat toggle), any website can make requests to localhost:4891 when API server is enabled.

Impact: user visits evil.com while GPT4All server runs. evil.com generates completions via /v1/chat/completions, reads model list via /v1/models. No auth token needed.

PoC: fetch('http://localhost:4891/v1/models').then(r=>r.json()).then(console.log) from any website.

Fix: remove wildcard CORS or add API key auth. Ollama had similar issue (CVE-2024-39720).