Anthropic CORS Spike (Migrationsamt, desktop Chrome)

Phase 0 spike. Tests whether a static page can call Anthropic Messages directly from the browser using the dangerous-direct-browser-access header. Key is read from the field below at runtime and is never stored or logged.