sunshine: allow the LAN origins past CSRF

Reaching the web UI from another machine sends an Origin header naming
this host rather than localhost, and Sunshine's CSRF check rejects it:

  Web UI: [10.0.0.8] -- CSRF protection blocked request from origin:
  https://10.0.0.2:47990

csrf_allowed_origins takes a comma-separated list of bare origins, NOT a
JSON array — brackets and quotes are rejected entry by entry, which is how
the first attempt failed. Both the IP and hostname spellings are listed
because the browser sends whichever was typed.

origin_web_ui_allowed=lan set explicitly alongside it, so the two settings
that gate remote access to the UI are stated in one place.

hosts/mainframe/sunshine/sunshine.conf

@@ -15,3 +15,13 @@ nvenc_preset = 1
 nvenc_twopass = quarter_res
 
 min_log_level = warning
+
+# The web UI is reached from other machines on the LAN, so their Origin header
+# names this host rather than localhost and Sunshine's CSRF check rejects it.
+# Both spellings are listed because the browser sends whichever you typed.
+# Comma-separated bare origins — not a JSON array; brackets and quotes are
+# rejected entry by entry.
+csrf_allowed_origins = https://10.0.0.2:47990,https://mainframe:47990,https://localhost:47990
+
+# Web UI reachable from the LAN, not just this machine.
+origin_web_ui_allowed = lan