After you link the plugin so its in node_modules, you need to activate it either from the ACP or from the CLI with ./nodebb activate nodebb-plugin-my-plugin
That field is passed to https://github.com/expressjs/cors#configuration-options, you might be able to just leave it out If not specified, defaults to reflecting the headers specified in the request's Access-Control-Request-Headers header.
Did you try changing your url field in config.json to http://127.0.0.1:4567? And change the connection code to also use 127.0.0.1:4567 instead of localhost.