MIV spike echo endpoints

Second origin for the Wix embed spike. Routes:

• /api/echo — permissive, always answers, reports what it saw
• /api/echo-strict — mirrors the Edge Functions' origin allow-list
• /api/echo-simple — no custom headers, so no preflight