feat(bootstrap): configurable HOST, CORS_ORIGINS, and optional rate limiting

crates/bootstrap/src/config.rs

@@ -8,6 +8,9 @@ pub struct Config {
     pub allow_registration: bool,
     /// true when RUST_ENV != "production" — enables AP debug mode
     pub debug: bool,
+    pub host: String,
+    pub cors_origins: String,
+    pub rate_limit: Option<u32>,
 }
 
 impl Config {
@@ -31,6 +34,9 @@ impl Config {
             debug: std::env::var("RUST_ENV")
                 .map(|v| v != "production")
                 .unwrap_or(true),
+            host: std::env::var("HOST").unwrap_or_else(|_| "0.0.0.0".into()),
+            cors_origins: std::env::var("CORS_ORIGINS").unwrap_or_else(|_| "*".into()),
+            rate_limit: std::env::var("RATE_LIMIT").ok().and_then(|v| v.parse().ok()),
         }
     }
 }