Support cross-origin frontends alongside same-origin setups

- django-cors-headers with env-driven CORS_ALLOWED_ORIGINS,
  CORS_ALLOW_ALL_ORIGINS, CORS_ALLOW_CREDENTIALS and CSRF_TRUSTED_ORIGINS;
  same-origin traffic is unaffected and a disallowed origin gets no CORS
  headers. Token auth needs no cookies, so credentials stay off by default.
- TRUST_PROXY_HEADERS=true lets a TLS-terminating proxy supply
  X-Forwarded-Proto/Host for correct absolute URLs.
- API media URLs (raw/thumbnail/upload/similarity/staged previews) are now
  absolute, built from the request host, so <img>/<video>/fetch() keep
  working when the SPA is served from another origin. Signed URLs are still
  per-user; nothing is stored in the DB.
- The SPA gains VITE_API_BASE (build-time, empty = same-origin) applied by
  a small apiUrl() helper used for XHR/fetch and the few URL fallbacks.

Verified with a throwaway instance: preflight and GET responses carry the
allowed origin, foreign origins get nothing, media GETs include CORS for
cross-origin fetch(), and payload URLs use the request host (dev :8000
unchanged).

backend/apps/accounts/serializers.py

@@ -1,10 +1,10 @@
 from pathlib import Path
 
 from django.contrib.auth.password_validation import validate_password
-from django.core import signing
 from rest_framework import serializers
 
-from apps.library.services import MEDIA_FILE_SALT, VIDEO_EXTENSIONS
+from apps.library.services import VIDEO_EXTENSIONS
+from apps.library.services import signed_media_url as signed_library_url
 
 from .models import User
 
@@ -22,11 +22,7 @@ def signed_media_url(request, item):
         and Path(location.rel_path).suffix.lower() in VIDEO_EXTENSIONS
     )
     action = "thumbnail" if is_video else "raw"
-    signature = signing.dumps(
-        {"item": item.id, "user": user.id, "action": action},
-        salt=MEDIA_FILE_SALT,
-    )
-    return f"/api/files/J-{item.id}/{action}/?sig={signature}"
+    return signed_library_url(item, user, action, request=request)
 
 
 class UserSerializer(serializers.ModelSerializer):