feat(api): config from env vars (HOST, PORT, CORS_ALLOWED_ORIGINS, DATABASE_URL)

.env.compose

@@ -4,11 +4,19 @@
 # Then run:
 #   docker compose --env-file .env.compose.local up -d --build
 
+# ── Frontend ──────────────────────────────────────────────────────────────────
 # URL your browser (and the SSR server) uses to reach the API.
+# Baked into the JS bundle at build time — rebuild the app image when changing.
 # LAN example:      http://192.168.1.100:8000
 # Reverse proxy:    https://pocketchords.yourdomain.com/api
 VITE_API_URL=http://localhost:8000
 
-# Host ports (change if something else is already using them)
+# ── Backend ───────────────────────────────────────────────────────────────────
+# Comma-separated allowed CORS origins, or * for any.
+# Lock this down when exposing publicly: https://pocketchords.yourdomain.com
+CORS_ALLOWED_ORIGINS=*
+
+# ── Ports (host-side) ─────────────────────────────────────────────────────────
+# Change if something else is already using these ports on the host.
 API_PORT=8000
 APP_PORT=3000