fix: allow local frontend cors origins

backend/.env.example

@@ -2,7 +2,7 @@ HLL_BACKEND_HOST=0.0.0.0
 HLL_BACKEND_PORT=8000
 HLL_BACKEND_STORAGE_PATH=/app/data/hll_vietnam_dev.sqlite3
 HLL_BACKEND_DATABASE_URL=postgresql://hll_vietnam:hll_vietnam_dev@postgres:5432/hll_vietnam
-HLL_BACKEND_ALLOWED_ORIGINS=http://127.0.0.1:8080,http://localhost:8080
+HLL_BACKEND_ALLOWED_ORIGINS=http://127.0.0.1,http://127.0.0.1:8080,http://localhost,http://localhost:8080
 HLL_BACKEND_REFRESH_INTERVAL_SECONDS=120
 HLL_BACKEND_LIVE_DATA_SOURCE=rcon
 HLL_BACKEND_HISTORICAL_DATA_SOURCE=rcon

backend/README.md

@@ -176,8 +176,10 @@ HTML si una demo local necesita un intervalo distinto.
 Valor por defecto de `HLL_BACKEND_ALLOWED_ORIGINS`:
 
 - `null`
+- `http://127.0.0.1`
 - `http://127.0.0.1:5500`
 - `http://127.0.0.1:8080`
+- `http://localhost`
 - `http://localhost:5500`
 - `http://localhost:8080`
 
@@ -1420,7 +1422,9 @@ locales mas comunes del proyecto:
 
 - `http://127.0.0.1:5500`
 - `http://localhost:5500`
+- `http://127.0.0.1`
 - `http://127.0.0.1:8080`
+- `http://localhost`
 - `http://localhost:8080`
 
 Las respuestas `GET` y `OPTIONS` incluyen `Access-Control-Allow-Origin` cuando

backend/app/config.py

@@ -41,8 +41,10 @@ DEFAULT_WRITER_LOCK_TIMEOUT_SECONDS = 120.0
 DEFAULT_WRITER_LOCK_POLL_INTERVAL_SECONDS = 1.0
 DEFAULT_ALLOWED_ORIGINS = (
     "null",
+    "http://127.0.0.1",
     "http://127.0.0.1:5500",
     "http://127.0.0.1:8080",
+    "http://localhost",
     "http://localhost:5500",
     "http://localhost:8080",
 )

backend/app/main.py

@@ -8,6 +8,7 @@ from http import HTTPStatus
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 
 from .config import get_allowed_origins, get_bind_address
+from .payloads import build_error_payload
 from .routes import resolve_get_payload
 
 
@@ -24,7 +25,15 @@ class HealthHandler(BaseHTTPRequestHandler):
         self.end_headers()
 
     def do_GET(self) -> None:  # noqa: N802 - BaseHTTPRequestHandler interface
-        status, payload = resolve_get_payload(self.path)
+        try:
+            status, payload = resolve_get_payload(self.path)
+        except Exception:  # noqa: BLE001 - preserve HTTP/CORS response on route failures
+            self._write_json(
+                HTTPStatus.INTERNAL_SERVER_ERROR,
+                build_error_payload("Unexpected backend error"),
+            )
+            return
+
         if status is None:
             self._write_json(
                 HTTPStatus.NOT_FOUND,