Assert Vary: Origin on the authorized CORS preflight too

Review follow-up: the reflected-origin contract matters most on the
OPTIONS preflight, where a cached response authorized for one origin
must never be served to another.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

tests/live-server.test.mjs

@@ -431,6 +431,10 @@ describe('live-server integration', () => {
     });
     assert.equal(preflight.status, 204);
     assert.equal(preflight.headers.get('access-control-allow-origin'), origin);
+    assert.ok(
+      /\bOrigin\b/i.test(preflight.headers.get('vary') || ''),
+      'Vary: Origin accompanies the reflected origin on the preflight too',
+    );
   });
 
   it('CORS: a loopback origin is reflected with Vary: Origin', async () => {