config: env-driven CORS, ports, log level, timezone

The CORS allowed-origins list, host port mappings, log level, container
timezone, and worker concurrency are now all driven by environment
variables with sane defaults. Same-origin access through the nginx
proxy keeps working with no config; direct cross-origin backend
access can be locked down via ALLOWED_ORIGINS.

- backend/config: ALLOWED_ORIGINS env (comma-separated, "*" for any)
  exposed via settings.cors_origins. LOG_LEVEL too.
- backend/main: build the CORS middleware from settings.cors_origins,
  auto-disable allow_credentials when origins is wildcard (CORS spec
  forbids credentials + "*").
- docker-compose: parameterize FRONTEND_PORT, BACKEND_PORT, REDIS_PORT,
  CELERYD_CONCURRENCY, LOG_LEVEL, and TZ via ${VAR:-default} so each
  has a working fallback if the .env entry is missing.
- .env.example: new template documenting every knob with examples.
- .env: pruned to only the values that diverge from .env.example;
  removed dead VITE_API_URL.
- README: configuration knobs table + "accessing from another machine"
  section explaining the same-origin proxy story.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.env

@@ -1,30 +1,20 @@
-# Environment variables for Mulita
-#
-# Set PHOTO_DIRS to the HOST path of your photo library. The compose file
-# mounts this at /photos inside the container, and on first boot Mulita
-# auto-creates a source root pointing at /photos so your library is
-# scanned with zero further configuration.
-#
-# Examples:
-#   macOS / Linux:    PHOTO_DIRS=/Users/you/Pictures
-#   Network share:    PHOTO_DIRS=/mnt/nas/photos
-#   Windows (WSL):    PHOTO_DIRS=/mnt/c/Users/you/Pictures
+# Mulita / PhotoVault local environment.
+# See .env.example for the full list of knobs and their docs.
+
+# REQUIRED — host path to your photo library.
 PHOTO_DIRS=/Users/dtoro/Pictures/MulitaTest
 
-# Redis configuration
-REDIS_URL=redis://localhost:6379
+# Ports — change if 3000 / 8001 collide with other services on the host.
+FRONTEND_PORT=3000
+BACKEND_PORT=8001
+REDIS_PORT=6379
 
-# Database URL
-DATABASE_URL=sqlite+aiosqlite:///data/db/mulita.db
+# CORS — wildcard for local dev. Lock down for real deployments.
+ALLOWED_ORIGINS=*
 
-# Celery configuration
-CELERY_BROKER_URL=redis://localhost:6379
-CELERY_RESULT_BACKEND=redis://localhost:6379
+# Logging + timezone.
+LOG_LEVEL=INFO
+TZ=UTC
+
+# Celery worker pool.
 CELERYD_CONCURRENCY=4
-
-# API settings
-API_HOST=0.0.0.0
-API_PORT=8000
-
-# Frontend settings
-VITE_API_URL=http://localhost:8000