config: env-driven CORS, ports, log level, timezone

The CORS allowed-origins list, host port mappings, log level, container
timezone, and worker concurrency are now all driven by environment
variables with sane defaults. Same-origin access through the nginx
proxy keeps working with no config; direct cross-origin backend
access can be locked down via ALLOWED_ORIGINS.

- backend/config: ALLOWED_ORIGINS env (comma-separated, "*" for any)
  exposed via settings.cors_origins. LOG_LEVEL too.
- backend/main: build the CORS middleware from settings.cors_origins,
  auto-disable allow_credentials when origins is wildcard (CORS spec
  forbids credentials + "*").
- docker-compose: parameterize FRONTEND_PORT, BACKEND_PORT, REDIS_PORT,
  CELERYD_CONCURRENCY, LOG_LEVEL, and TZ via ${VAR:-default} so each
  has a working fallback if the .env entry is missing.
- .env.example: new template documenting every knob with examples.
- .env: pruned to only the values that diverge from .env.example;
  removed dead VITE_API_URL.
- README: configuration knobs table + "accessing from another machine"
  section explaining the same-origin proxy story.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/main.py

@@ -64,14 +64,18 @@ app = FastAPI(
 
 # Configure CORS. The frontend normally talks to the backend through the
 # nginx (prod) or vite (dev) proxy, so requests are same-origin and never
-# trip CORS. The wildcard here is a fallback for the rare case where a
-# user / script hits the backend directly from a browser at some other
-# origin (LAN IP, reverse proxy under a different host, etc.). This is a
-# single-user homelab tool, so a permissive CORS policy is fine.
+# trip CORS. ALLOWED_ORIGINS in .env controls the fallback for direct
+# browser access from other origins (LAN IP, reverse proxy under a
+# different host). Defaults to "*" since this is a single-user homelab
+# tool; lock it down by setting e.g. ALLOWED_ORIGINS=https://photos.your.tld
+# in production deployments.
+_origins = settings.cors_origins
 app.add_middleware(
     CORSMiddleware,
-    allow_origins=["*"],
-    allow_credentials=False,
+    allow_origins=_origins,
+    # Wildcard origins can't be combined with credentials per the CORS
+    # spec, so credentials get auto-disabled in that case.
+    allow_credentials=_origins != ["*"],
     allow_methods=["*"],
     allow_headers=["*"],
 )