config: env-driven CORS, ports, log level, timezone

The CORS allowed-origins list, host port mappings, log level, container
timezone, and worker concurrency are now all driven by environment
variables with sane defaults. Same-origin access through the nginx
proxy keeps working with no config; direct cross-origin backend
access can be locked down via ALLOWED_ORIGINS.

- backend/config: ALLOWED_ORIGINS env (comma-separated, "*" for any)
  exposed via settings.cors_origins. LOG_LEVEL too.
- backend/main: build the CORS middleware from settings.cors_origins,
  auto-disable allow_credentials when origins is wildcard (CORS spec
  forbids credentials + "*").
- docker-compose: parameterize FRONTEND_PORT, BACKEND_PORT, REDIS_PORT,
  CELERYD_CONCURRENCY, LOG_LEVEL, and TZ via ${VAR:-default} so each
  has a working fallback if the .env entry is missing.
- .env.example: new template documenting every knob with examples.
- .env: pruned to only the values that diverge from .env.example;
  removed dead VITE_API_URL.
- README: configuration knobs table + "accessing from another machine"
  section explaining the same-origin proxy story.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

README.md

@@ -43,19 +43,16 @@ git clone <repository-url>
 cd muleimage
 ```
 
-2. Set **one** environment variable in `.env` — the **host** directory
-   that contains your photo library. Whatever you point at will become
-   your library inside Mulita.
+2. Copy the example env file and set **one** variable — the **host**
+   directory that contains your photo library. Whatever you point at
+   will become your library inside Mulita.
 
    ```bash
-   # macOS / Linux
-   PHOTO_DIRS=/Users/you/Pictures
-
-   # or any folder
-   PHOTO_DIRS=/mnt/nas/photos
-
-   # Windows (WSL)
-   PHOTO_DIRS=/mnt/c/Users/you/Pictures
+   cp .env.example .env
+   # then edit .env and set PHOTO_DIRS:
+   #   macOS / Linux:    PHOTO_DIRS=/Users/you/Pictures
+   #   Network share:    PHOTO_DIRS=/mnt/nas/photos
+   #   Windows (WSL):    PHOTO_DIRS=/mnt/c/Users/you/Pictures
    ```
 
 3. Start the stack:
@@ -70,6 +67,38 @@ docker compose up -d
 
 You don't need to touch `mulita.yml` or the API to get started.
 
+### Configuration knobs
+
+Everything is environment-driven. `PHOTO_DIRS` is the only required
+value; the rest have sensible defaults documented in `.env.example`:
+
+| Variable             | Default | Notes                                              |
+|----------------------|---------|----------------------------------------------------|
+| `PHOTO_DIRS`         | —       | **Required.** Host path mounted at `/photos`.      |
+| `FRONTEND_PORT`      | `3000`  | SPA host port. Bump if `3000` is taken.            |
+| `BACKEND_PORT`       | `8001`  | Direct backend port (debug only — frontend uses internal nginx proxy). |
+| `REDIS_PORT`         | `6379`  | Redis host port (internal services don't need it). |
+| `ALLOWED_ORIGINS`    | `*`     | Comma-separated CORS origins for direct backend access. Lock down for prod, e.g. `https://photos.example.com`. |
+| `LOG_LEVEL`          | `INFO`  | Backend + worker log level. `DEBUG` for chasing scan issues. |
+| `TZ`                 | `UTC`   | Container timezone. Affects log timestamps and "added at". |
+| `CELERYD_CONCURRENCY`| `4`     | Parallel worker processes (scans, thumbs, metadata). Lower on a Pi, higher on a beefy host. |
+
+### Accessing from another machine
+
+The frontend talks to the backend through its bundled nginx, which
+proxies `/api/` to the backend on the internal compose network. That
+means requests are always **same-origin** as the page, so accessing
+Mulita from another host works without any CORS dance:
+
+```
+http://<your-server-ip>:3000
+```
+
+If you want to put it behind a reverse proxy at e.g.
+`https://photos.your.tld`, set `ALLOWED_ORIGINS` to that host so the
+backend's direct port (`BACKEND_PORT`) also accepts cross-origin
+requests if anything bypasses the proxy.
+
 ### How libraries are managed
 
 Mulita is **config-driven**: the host directory you mount via