Fix: add CORS header to the e2e filter_selection_data stub response

The e2e app (localhost:4200) calls the backend at localhost:8000, a
cross-origin request from the browser's perspective. Recorded HAR
responses carry the real backend's Access-Control-Allow-Origin header,
which is why they work; the stub added in the previous commit didn't
set one, so the browser rejected the fulfilled response as a CORS
violation -- same symptom as the original bug (TypeError: Failed to
fetch), confirmed via a fresh CI run after the first e2e fix attempt.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

src-ui/e2e/mock-filter-selection-data.ts

@@ -22,6 +22,14 @@ const EMPTY_SELECTION_DATA = {
  */
 export async function mockFilterSelectionData(page: Page) {
   await page.route('**/api/documents/filter_selection_data/**', (route) =>
-    route.fulfill({ json: EMPTY_SELECTION_DATA })
+    route.fulfill({
+      json: EMPTY_SELECTION_DATA,
+      // The app calls the (cross-origin, from the e2e app's perspective)
+      // backend at http://localhost:8000 while served from :4200, so a
+      // fulfilled response needs the same CORS header the real backend
+      // sends (and that recorded HAR responses already carry) or the
+      // browser rejects it as a cross-origin failure.
+      headers: { 'Access-Control-Allow-Origin': 'http://localhost:4200' },
+    })
   )
 }