Fix cross-origin requests answering 500 instead of being denied

[ryanio]

A request carrying an Origin header from outside the allowlist answers 500,
on every route, static assets included.

curl -s -o /dev/null -w '%{http_code}\n' https://www.voxels.com/models/avatar.glb
200
curl -s -o /dev/null -w '%{http_code}\n' -H 'Origin: https://example.com' https://www.voxels.com/models/avatar.glb
500

The origin callback in server/server.ts hands cors an Error for an origin
it does not allow. The middleware passes that to next(err), so the request
fails rather than being answered without the header. callback(null, false) is
the deny: the response goes out as normal and the browser blocks the read
itself, which is what the allowlist was for.

Same for /animations/*.glb and every JSON route, so a third-party page cannot
tell a blocked read from a broken server, and error tracking sees 500s that are
not.

Checked with prettier, tsc --noEmit --project tsconfig.precommit.json (no new
errors) and pnpm test (129 green). Happy to check the built branch against
womp.world, which reads this API in production, before it ships.