chore: bump both submodules and let the proxy wrapper allow a published host

cloudcli moves to d12813e1, which carries the fix this workspace was missing:
PluginsProvider and TasksSettingsProvider sit above ProtectedRoute and fetched
exactly once, on mount, so in a browser holding no token yet the request landed
on the login screen, came back 401, and nothing asked again — the whole session
then ran with an empty plugin list and no Tasks section until a reload.
plugin-taskwork moves to fdae5240, which keeps a task draft that loses focus.

dev-host-proxy.sh gains ALLOWED_HOST. Publishing the dev host under a name
rather than localhost — a port forward, a reverse proxy — otherwise ends at
Vite's "Blocked request. This host is not allowed.". The value goes into the
variable Vite reads for exactly this, so vite.config.js needs no local patch,
and leaving ALLOWED_HOST unset passes an empty string, which Vite ignores.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cloudcli

@@ -1 +1 @@
-Subproject commit 25ad3342d3843aae51e76cde5588a7b594341a53
+Subproject commit d12813e1253f2075f50a375f00d245f82f214c43

plugin-taskwork

@@ -1 +1 @@
-Subproject commit cadd21e8fed0237575f873d5f2abca8a01356163
+Subproject commit fdae5240077e0c014f17ef50eb38b0b6748b63e7

scripts/dev-host-proxy.sh

@@ -13,8 +13,20 @@ export http_proxy="$HTTP_PROXY"
 export https_proxy="$HTTPS_PROXY"
 export no_proxy="$NO_PROXY"
 
+# Reaching the host through a name rather than localhost — publishing it behind
+# a port forward or a reverse proxy — needs that name allowed: Vite answers
+# "Blocked request. This host is not allowed." to every other Host header.
+#
+# ALLOWED_HOST carries it. The variable Vite reads is its own escape hatch: it
+# appends the value to server.allowedHosts, so cloudcli/vite.config.js stays
+# untouched. One name per run — the value is appended whole, commas are not
+# split. Unset means an empty string, which Vite ignores, so leaving it alone
+# keeps the default localhost-only behaviour.
+export __VITE_ADDITIONAL_SERVER_ALLOWED_HOSTS="${ALLOWED_HOST:-}"
+
 echo "-------"
 echo "HTTP_PROXY=${HTTP_PROXY}"
+echo "ALLOWED_HOST=${ALLOWED_HOST:-(none, localhost only)}"
 echo "-------"