I am afraid there’s no way for me to provide any constructive help beyond the preceding recommendations with the partial visibility into the environment and the differing failure modes they cause.
It seems that things are failing due to mixed protocols, connection refusal, or the most recent 404: Not Found error.
For what it’s worth, when embarking on my implementations initially, I did experience CORS errors and experimented with using the Flask CORS extension as you have highlighted. But, in any of my ultimate deployment scenarios (locally, deployed in Heroku, etc.) this never was ultimately necessary.
In your latest simplified example with the Flask development server, how are you actually running the bokeh server?
If it is separately via bokeh serve ..., are you explicitly setting the address and port where it runs consistent with your flask app? What messages do you see in the terminal window where bokeh server is running? Have you enabled the xheaders option? Have you looked at log files with the log level set to debug as mentioned above?