Thanks to the fine folk on the Discord I got this working right. For other Node.JS devs out there facing the same issue, just use the cors NPM package and follow this document:
https://expressjs.com/en/resources/middleware/cors.html
My extension now works in hosted mode.