CDP endpoint: /json returns [] before any target exists, and browser-level WS rejects Origin header - breaks DrissionPage #3935

Title: CDP endpoint: /json returns [] before any target exists, and browser-level WebSocket rejects connections with an Origin header — breaks DrissionPage (and other clients that send Origin)

Version: 1.1.0-nightly.10512+0d3b3659f (macOS arm64, via Homebrew)

Summary

Two CDP-compat issues make Python clients other than Playwright fail to connect to lightpanda serve:

1. GET /json returns [] until a target has been created via raw CDP, so clients that probe /json for a type: page entry (e.g. DrissionPage's test_connect) conclude there is no browser on the port — even after Target.createTarget succeeds over WS, /json still lists nothing.
2. The browser-level WebSocket endpoint (ws://127.0.0.1:9222/) rejects any handshake carrying an Origin header with HTTP 403 Origin not allowed. websocket-client sends Origin by default, so it fails unless suppress_origin=True is passed.

Repro

lightpanda serve --host 127.0.0.1 --port 9222

# 1) /json is empty, unlike Chromium which lists at least one page target
curl -s http://127.0.0.1:9222/json
# -> []

# 2) WS handshake with default Origin header is rejected
python3 - <<'EOF'
import websocket, json
ws = websocket.create_connection("ws://127.0.0.1:9222/", timeout=10)  # sends Origin
ws.send(json.dumps({"id": 1, "method": "Target.createTarget", "params": {"url": "about:blank"}}))
print(ws.recv())
EOF
# -> WebSocketBadStatusException: Handshake status 403 ... Origin not allowed

# Works only with suppress_origin=True:
websocket.create_connection("ws://127.0.0.1:9222/", timeout=10, suppress_origin=True)

# 3) Even after createTarget succeeds, /json is still empty
curl -s http://127.0.0.1:9222/json   # -> []

Impact

• DrissionPage (popular in the Chinese automation ecosystem) fails outright with BrowserConnectError: its connect_browser() polls /json for a type: page tab before attaching. Playwright works fine (it creates targets itself), but the promise of "existing CDP scripts just work" breaks for DrissionPage users.
• Any WS client that sends an Origin header (websocket-client default, some browsers tools) gets a 403.

Expected

1. /json should list existing page targets (like Chromium does), or at least after Target.createTarget.
2. Browser-level WS endpoint should either accept same-host Origin values (e.g. http://127.0.0.1:<port>) or document the allowlist mechanism. Chromium's behavior: accepts connections regardless of Origin on the DevTools port.

Notes

Benchmark + markdown dump (lightpanda fetch --dump markdown) work great — this is only about first-connection compatibility.