fix: add Tailwind CSS, Unsplash, and popular CDNs to asset proxy allowlist

[davideast]

Problem

The /_stitch/asset proxy returns 404 for Tailwind CSS and Unsplash images, breaking visual rendering of Stitch-generated screens.

When the local serve command (stitch-mcp serve -p <id> --json) hosts screens, the AssetGateway rewrites external URLs like:

<script src="https://cdn.tailwindcss.com?plugins=forms,container-queries">

into proxied form:

<script src="/_stitch/asset?url=https%3A%2F%2Fcdn.tailwindcss.com%3Fplugins%3Dforms%2Ccontainer-queries">

But AssetGateway.validateAssetUrl() rejects cdn.tailwindcss.com because it is not in the ALLOWED_HOST_PATTERNS allowlist — causing the proxy to return null and the middleware to respond with 404.

User-visible symptoms:

• ReferenceError: tailwind is not defined — the Tailwind config block runs before the CDN script loads
• Entire page renders without any styles (raw HTML)
• Unsplash background images fail to load

Root Cause

ALLOWED_HOST_PATTERNS only contained Google-owned domains (googleapis.com, gstatic.com, googleusercontent.com) and cdnjs.cloudflare.com. Stitch generation model frequently emits Tailwind CSS CDN references and Unsplash image URLs, neither of which were in the allowlist.

Fix

Added 4 commonly-used CDN domains to the allowlist:

Domain	Usage
cdn.tailwindcss.com	Tailwind CSS CDN (used in virtually every generated screen)
images.unsplash.com	Stock photography in generated UI
cdn.jsdelivr.net	jsDelivr CDN (Alpine.js, other libraries)
unpkg.com	unpkg CDN (HTMX, etc.)

Testing

Added 10 new validateAssetUrl tests covering:

• All 8 allowed domain patterns (4 existing + 4 new)
• Rejection of non-HTTPS URLs
• Rejection of arbitrary/unknown domains
• Rejection of malformed URLs

52 pass | 0 fail | 72 expect() calls