security: add SRI, remove Tailwind CDN, restrict CORS

- Add SRI hash to Alpine.js (integrity + crossorigin)
- Remove Tailwind CDN, use prebuilt style.css only
- Add CSS variables for terminal theme colors
- Restrict CORS to https://hosting.anvil.it.com

Performance: ~500ms LCP improvement (no JIT compilation)
Security: CDN tampering protection, API access restriction

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

functions/api/pricing.ts

@@ -70,7 +70,7 @@ async function fetchExchangeRate(): Promise<{ rate: number; source: string }> {
 }
 
 const CORS_HEADERS = {
-  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Origin': 'https://hosting.anvil.it.com',
   'Access-Control-Allow-Methods': 'GET, OPTIONS',
   'Access-Control-Allow-Headers': 'Content-Type',
 };