#10827 Exempt the app's own web origin from Cloud VM loopback-alias rewriting

Fixes https://github.com/manaflow-ai/cmux/issues/10817.

On dev builds, cmux vm desktop <id> opens the noVNC wrapper at http://localhost:<port>/vm/desktop/<id>?cmux_token=... on the local dev web server. In a Cloud VM workspace, BrowserPanel rewrote that loopback URL to cmux-loopback.localtest.me, so the workspace proxy dialed the dev web port from the remote daemon, where nothing listens, and the pane showed "No internet connection" (reproduced live on VMs sharp-newt and amber-newt; the identical URL renders in a non-VM workspace).

Mechanism: the rewrite decision moves into CmuxCore as RemoteLoopbackProxyAlias.browserLoopbackAliasURL(for:exemptWebOrigin:). It aliases every cleartext-http loopback URL except ones sharing the exempt origin, compared as scheme + loopback-family host (localhost/127.0.0.1/::1/0.0.0.0 collapse, *.localhost subdomains stay distinct) + effective port. BrowserPanel.remoteProxyLoopbackAliasURL forwards to it with AuthEnvironment.vmAPIBaseURL, the same config the app used to reach the web endpoint that minted the wrapper URL (web/app/api/vm/[id]/open-port mints it from the request origin). The exemption is origin-specific, never workspace-wide: open-port previews of apps running inside the VM (any other port) keep proxying.

Coverage: both pane-creation navigation and favicon fetches flow through the one changed helper (remoteProxyPreparedRequest). The in-page runtime bridge (RemoteLoopbackRuntimeBridge) installs only on alias-host pages, so it never runs on the now-unaliased wrapper; inside aliased VM pages, localhost still means the VM, unchanged.

Two commits so CI goes red then green: commit 1 adds the failing CmuxCore tests, commit 2 adds the fix.

Verified: swift test in Packages/macOS/CmuxCore (11/11 in the alias suite, 63 total), tagged compile-only xcodebuild -scheme cmux build with -derivedDataPath /tmp/cmux-fixloop succeeded. Not verified: live dogfood of a Cloud VM desktop pane on a dev web server.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

Summary by CodeRabbit

• New Features
  • Improved remote workspace browsing by automatically rewriting HTTP links that target local services.
  • Supports localhost, loopback IP addresses, and loopback subdomains while preserving URL details.
  • Recognizes equivalent loopback origins and default ports when applying configured exclusions.
• Bug Fixes
  • Prevents rewriting non-HTTP links, external addresses, and designated application web origins.
  • Ensures other loopback services continue to work through the remote connection.