fix: allow cross-origin image loading + hide legend on small screens

- Set crossOriginResourcePolicy: cross-origin in helmet so browsers
  can load uploaded images from api.hotelsync.ru when app runs on
  app.hotelsync.ru (was blocked by same-origin CORP header)
- Hide booking status legend squares below lg breakpoint (hidden lg:flex)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/src/app.ts

@@ -49,7 +49,7 @@ export async function buildApp() {
   await fastify.register(staticFiles, { root: uploadsDir, prefix: '/uploads/' })
 
   // ── Security ───────────────────────────────────────────────────────────────
-  await fastify.register(helmet, { contentSecurityPolicy: false })
+  await fastify.register(helmet, { contentSecurityPolicy: false, crossOriginResourcePolicy: { policy: 'cross-origin' } })
 
   await fastify.register(cors, {
     origin: config.cors.origins,