feat: add deep research planning and postal batch runs

Add a dedicated Deep Research view with postal-area preview overlays, batch execution, and bundled map results.

Also add postal dataset import tooling and fix local API networking and research insert issues needed to support the new workflow.

server/src/app.ts

@@ -2,19 +2,43 @@ import Fastify from 'fastify';
 import cookie from '@fastify/cookie';
 import cors from '@fastify/cors';
 import { getEnv } from './config/env.js';
+import { deepResearchRoutes } from './routes/deep-research.js';
 import { authRoutes } from './routes/auth.js';
 import { healthRoutes } from './routes/health.js';
 import { searchJobRoutes } from './routes/search-jobs.js';
 
+function parseAllowedOrigins(rawOrigins: string) {
+  return rawOrigins
+    .split(',')
+    .map((origin) => origin.trim())
+    .filter(Boolean);
+}
+
+function resolveCorsOrigin(origin: string | undefined, allowedOrigins: string[], isProduction: boolean) {
+  if (!origin) {
+    return true;
+  }
+
+  if (!isProduction) {
+    return origin;
+  }
+
+  return allowedOrigins.includes(origin) ? origin : false;
+}
+
 export async function buildApp() {
   const env = getEnv();
+  const allowedOrigins = parseAllowedOrigins(env.APP_ORIGIN);
   const app = Fastify({
     logger: true,
   });
 
   await app.register(cors, {
-    origin: env.APP_ORIGIN,
+    origin(origin, callback) {
+      callback(null, resolveCorsOrigin(origin, allowedOrigins, env.NODE_ENV === 'production'));
+    },
     credentials: true,
+    methods: ['GET', 'HEAD', 'POST', 'PUT', 'PATCH', 'DELETE', 'OPTIONS'],
   });
 
   await app.register(cookie, {
@@ -25,6 +49,7 @@ export async function buildApp() {
   await app.register(healthRoutes, { prefix: '/api' });
   await app.register(authRoutes, { prefix: '/api' });
   await app.register(searchJobRoutes, { prefix: '/api' });
+  await app.register(deepResearchRoutes, { prefix: '/api' });
 
   return app;
 }