fix: add try/catch for SSE JSON parsing and tighten CORS default

[marceli1404]

Changes

• Wrap JSON.parse(data) in try/catch in SSE event handler to prevent Electron crash on malformed data
• Change CORS default from wildcard * to http://localhost:3000

Why

Malformed SSE data from the backend would crash the entire Electron main process. The wildcard CORS allows any origin to make requests, which is a security concern.