fix: /sidebar 信任栅栏改用 webRuntime.trustedHosts，修复远程访问全部 403

根因：trustedHostsOf 按 entry.options.name === 'connection' 查找 connection
行，但该行 name 是模块标识符（@deepseek-ai/dsh-client-connection，id 才是
connection），查找永远落空 → trustedHosts 为空 → 栅栏只放行回环 Host → 通过
域名或局域网 IP 访问时 /sidebar/bundle chunk 加载失败、资源管理器/代码管理器
全部 403 forbidden（/api 不受影响，它读的是 apply 时已求值的配置）。

修复（按 review 建议）：host half 直接注入 webRuntime 服务，栅栏每请求实时
读取 ctx.webRuntime.trustedHosts —— 与 /api 网关同一信任列表（启动时采样的
LAN IP 字面量 + --trusted-host 权威），不再依赖 Loader entry / fiber /
!!js 节点求值；自定义信任域名由 dsh web --trusted-host 提供。

新增 tests/trusted-hosts.spec.ts 回归：域名/局域网放行、空列表仅回环、
跨站标记拒绝、每请求实时读取；plugin-shape 断言同步更新。

src/context-types.ts

@@ -12,7 +12,7 @@
  * - conversation: client side ui-conversation's IConversation (composer
  *   draft), read lazily through `ctx.get` — cross-plugin service reads need
  *   an inject declaration, so the direct property is never typed here
- * - loader: @cordisjs/plugin-loader (entry options)
+ * - webRuntime: @deepseek-ai/dsh-web-app (bind-derived trusted hosts)
  * - slots: the client runtime SlotRegistry
  * - effect: the DSH-vendored cordis lifecycle helper
  * Drift from upstream is contained to this file.
@@ -102,6 +102,16 @@ export interface SidebarLoader {
   entries(): Iterable<SidebarLoaderEntry>
 }
 
+/**
+ * The web runtime service face (mirror of @deepseek-ai/dsh-web-app's
+ * WebRuntimeValues): the bind-derived trust list the /api gateway's fence
+ * accepts — LAN IP literals sampled when the server binds all interfaces,
+ * plus explicit `--trusted-host` authorities.
+ */
+export interface SidebarWebRuntime {
+  trustedHosts: readonly string[]
+}
+
 /** Registration options the sidebar passes to `ctx.slots.register` (subset of the real options). */
 export interface SidebarSlotRegisterOptions {
   name: string
@@ -416,7 +426,7 @@ declare module 'cordis' {
     webServer: SidebarWebServer
     sessions: SidebarSessionStore & SidebarSessionsService
     connection: SidebarConnectionHandle
-    loader: SidebarLoader
+    webRuntime: SidebarWebRuntime
     slots: SidebarSlotsService
     workspaces: SidebarWorkspacesService
     settings: SidebarSettingsService