fix(api): use getTrustedOrigins() for WebSocket CORS instead of WEB_URL

The WebSocket gateway was hardcoded to `process.env.WEB_URL ?? "http://localhost:3000"`
for CORS origin, while the main API uses getTrustedOrigins() which reads TRUSTED_ORIGINS.
In production, WEB_URL was not set, causing CORS to reject connections from
mosaic.woltje.com with "Access-Control-Allow-Origin: http://localhost:3000".

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

apps/api/src/websocket/websocket.gateway.ts

@@ -7,6 +7,7 @@ import {
 import { Logger } from "@nestjs/common";
 import { Server, Socket } from "socket.io";
 import { AuthService } from "../auth/auth.service";
+import { getTrustedOrigins } from "../auth/auth.config";
 import { PrismaService } from "../prisma/prisma.service";
 
 interface AuthenticatedSocket extends Socket {
@@ -77,7 +78,7 @@ interface StepOutputData {
  */
 @WSGateway({
   cors: {
-    origin: process.env.WEB_URL ?? "http://localhost:3000",
+    origin: getTrustedOrigins(),
     credentials: true,
   },
 })