config: env-driven CORS, ports, log level, timezone

The CORS allowed-origins list, host port mappings, log level, container
timezone, and worker concurrency are now all driven by environment
variables with sane defaults. Same-origin access through the nginx
proxy keeps working with no config; direct cross-origin backend
access can be locked down via ALLOWED_ORIGINS.

- backend/config: ALLOWED_ORIGINS env (comma-separated, "*" for any)
  exposed via settings.cors_origins. LOG_LEVEL too.
- backend/main: build the CORS middleware from settings.cors_origins,
  auto-disable allow_credentials when origins is wildcard (CORS spec
  forbids credentials + "*").
- docker-compose: parameterize FRONTEND_PORT, BACKEND_PORT, REDIS_PORT,
  CELERYD_CONCURRENCY, LOG_LEVEL, and TZ via ${VAR:-default} so each
  has a working fallback if the .env entry is missing.
- .env.example: new template documenting every knob with examples.
- .env: pruned to only the values that diverge from .env.example;
  removed dead VITE_API_URL.
- README: configuration knobs table + "accessing from another machine"
  section explaining the same-origin proxy story.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docker-compose.yml

@@ -2,12 +2,14 @@ version: '3.8'
 
 services:
   frontend:
-    build: 
+    build:
       context: ./frontend
       dockerfile: Dockerfile
     container_name: mulita-frontend
     ports:
-      - "3000:80"
+      # Host port is configurable via FRONTEND_PORT in .env so multiple
+      # instances / other services on the same host don't collide.
+      - "${FRONTEND_PORT:-3000}:80"
     depends_on:
       - backend
     networks:
@@ -20,7 +22,10 @@ services:
       dockerfile: Dockerfile
     container_name: mulita-backend
     ports:
-      - "8001:8000"
+      # Direct backend access on the host is rarely needed (the frontend
+      # talks to it through the nginx /api proxy on the same network),
+      # but it's exposed for debugging / curl. Override with BACKEND_PORT.
+      - "${BACKEND_PORT:-8001}:8000"
     volumes:
       - ./mulita.yml:/app/config/mulita.yml:ro
       # The single host → container mount for your photo library. Set
@@ -38,6 +43,9 @@ services:
       - CELERY_BROKER_URL=redis://redis:6379
       - CELERY_RESULT_BACKEND=redis://redis:6379
       - PHOTO_DIRS=${PHOTO_DIRS:-/photos}
+      - ALLOWED_ORIGINS=${ALLOWED_ORIGINS:-*}
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - TZ=${TZ:-UTC}
     depends_on:
       - redis
     networks:
@@ -49,7 +57,7 @@ services:
       context: ./backend
       dockerfile: Dockerfile
     container_name: mulita-worker
-    command: celery -A app.tasks.celery worker --loglevel=info --concurrency=4
+    command: celery -A app.tasks.celery worker --loglevel=${LOG_LEVEL:-info} --concurrency=${CELERYD_CONCURRENCY:-4}
     volumes:
       - ./mulita.yml:/app/config/mulita.yml:ro
       - ${PHOTO_DIRS:-./photos}:/photos:rw
@@ -62,7 +70,9 @@ services:
       - CELERY_BROKER_URL=redis://redis:6379
       - CELERY_RESULT_BACKEND=redis://redis:6379
       - PHOTO_DIRS=${PHOTO_DIRS:-/photos}
-      - CELERYD_CONCURRENCY=4
+      - CELERYD_CONCURRENCY=${CELERYD_CONCURRENCY:-4}
+      - LOG_LEVEL=${LOG_LEVEL:-INFO}
+      - TZ=${TZ:-UTC}
     depends_on:
       - redis
       - backend
@@ -73,8 +83,10 @@ services:
   redis:
     image: redis:7-alpine
     container_name: mulita-redis
+    # Host port exposed only for local debugging; the backend / worker
+    # reach Redis via the internal mulita-network on its container name.
     ports:
-      - "6379:6379"
+      - "${REDIS_PORT:-6379}:6379"
     volumes:
       - redis_data:/data
     networks: