config: env-driven CORS, ports, log level, timezone

The CORS allowed-origins list, host port mappings, log level, container
timezone, and worker concurrency are now all driven by environment
variables with sane defaults. Same-origin access through the nginx
proxy keeps working with no config; direct cross-origin backend
access can be locked down via ALLOWED_ORIGINS.

- backend/config: ALLOWED_ORIGINS env (comma-separated, "*" for any)
  exposed via settings.cors_origins. LOG_LEVEL too.
- backend/main: build the CORS middleware from settings.cors_origins,
  auto-disable allow_credentials when origins is wildcard (CORS spec
  forbids credentials + "*").
- docker-compose: parameterize FRONTEND_PORT, BACKEND_PORT, REDIS_PORT,
  CELERYD_CONCURRENCY, LOG_LEVEL, and TZ via ${VAR:-default} so each
  has a working fallback if the .env entry is missing.
- .env.example: new template documenting every knob with examples.
- .env: pruned to only the values that diverge from .env.example;
  removed dead VITE_API_URL.
- README: configuration knobs table + "accessing from another machine"
  section explaining the same-origin proxy story.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/config.py

@@ -70,7 +70,29 @@ class Settings(BaseSettings):
     # API settings
     api_host: str = Field(default="0.0.0.0", env="API_HOST")
     api_port: int = Field(default=8000, env="API_PORT")
-    
+
+    # CORS — comma-separated list of allowed origins, or "*" for any.
+    # Same-origin requests (the normal case behind nginx / vite proxy)
+    # never trip CORS, so this is only for direct browser access from
+    # other origins (LAN IP, reverse proxy, dev tools).
+    allowed_origins: str = Field(default="*", env="ALLOWED_ORIGINS")
+
+    # Logging — accepts standard python levels (DEBUG, INFO, WARNING,
+    # ERROR, CRITICAL). Bumped from INFO when chasing a problem.
+    log_level: str = Field(default="INFO", env="LOG_LEVEL")
+
+    @property
+    def cors_origins(self) -> list[str]:
+        """Parse the ALLOWED_ORIGINS env var into a list. Accepts:
+          - "*" → wildcard (single-element list ["*"])
+          - "http://a.com,http://b.com" → split + strip
+        Empty entries are dropped.
+        """
+        raw = (self.allowed_origins or "").strip()
+        if not raw or raw == "*":
+            return ["*"]
+        return [o.strip() for o in raw.split(",") if o.strip()]
+
     # App configuration from YAML
     _config: Optional[MulitaConfig] = None