Support cross-origin frontends alongside same-origin setups

- django-cors-headers with env-driven CORS_ALLOWED_ORIGINS,
  CORS_ALLOW_ALL_ORIGINS, CORS_ALLOW_CREDENTIALS and CSRF_TRUSTED_ORIGINS;
  same-origin traffic is unaffected and a disallowed origin gets no CORS
  headers. Token auth needs no cookies, so credentials stay off by default.
- TRUST_PROXY_HEADERS=true lets a TLS-terminating proxy supply
  X-Forwarded-Proto/Host for correct absolute URLs.
- API media URLs (raw/thumbnail/upload/similarity/staged previews) are now
  absolute, built from the request host, so <img>/<video>/fetch() keep
  working when the SPA is served from another origin. Signed URLs are still
  per-user; nothing is stored in the DB.
- The SPA gains VITE_API_BASE (build-time, empty = same-origin) applied by
  a small apiUrl() helper used for XHR/fetch and the few URL fallbacks.

Verified with a throwaway instance: preflight and GET responses carry the
allowed origin, foreign origins get nothing, media GETs include CORS for
cross-origin fetch(), and payload URLs use the request host (dev :8000
unchanged).

backend/.env.example

@@ -1,6 +1,18 @@
 SECRET_KEY=change-me-to-a-long-random-string
 DEBUG=True
 ALLOWED_HOSTS=localhost,127.0.0.1
+
+# Cross-origin frontends (comma separated). Same-origin keeps working with an
+# empty list; add e.g. https://j621.example.com when the SPA is served from
+# another origin than this API.
+# CORS_ALLOWED_ORIGINS=https://j621.example.com
+# CORS_ALLOW_ALL_ORIGINS=false
+# CORS_ALLOW_CREDENTIALS=false
+# CSRF_TRUSTED_ORIGINS=https://j621.example.com
+# Trust X-Forwarded-Proto/Host from a TLS-terminating reverse proxy so media
+# URLs keep https and the public hostname.
+# TRUST_PROXY_HEADERS=true
+
 # Absolute path to your media folder, or relative to the backend/ folder.
 WATCHED_FOLDER=media/library