Update configuration and documentation

- Update .env.example with latest environment variables
- Update deployment and task documentation
- Update backend configuration settings

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.env.example

@@ -48,3 +48,13 @@ BANGUI_GEOIP_DB_PATH=
 # Set to "true" to enable (default is "false" for security).
 BANGUI_GEOIP_ALLOW_HTTP_FALLBACK=false
 
+# CORS Configuration (optional)
+# Comma-separated list of allowed origins for cross-origin requests.
+# Defaults to common localhost development origins (http://localhost:5173, http://127.0.0.1:5173, etc).
+# Set this in production to your frontend domain(s).
+# Examples:
+#   BANGUI_CORS_ALLOWED_ORIGINS=https://example.com,https://app.example.com
+#   BANGUI_CORS_ALLOWED_ORIGINS=  (empty to disable CORS)
+# WARNING: Do NOT use wildcard "*" — it defeats CORS security when credentials are enabled.
+BANGUI_CORS_ALLOWED_ORIGINS=
+