Let the frontend call the API #67

Problem

The frontend and backend run on different origins, and the backend sends no CORS headers, so the browser blocks every API call from the frontend. The frontend also has no setting for where the API lives.

Goal

The frontend can call the backend locally and once deployed, with the API address set per environment.

Scope

• CORS middleware on the backend, with allowed origins read from a new setting (e.g. CORS_ORIGINS) in config.py and listed in .env.example.
• The frontend reads the API base URL from a Vite env variable (e.g. VITE_API_URL), with a local default.
• Optionally a Vite dev proxy for local development; pick one approach and note it in the README.
• Not in scope: the frontend API client and pages (frontend issues).

Considerations

• Allow only the listed origins; no * in production.
• If logins use cookies, CORS must allow credentials, which also rules out *. Agree this with the auth work.

Acceptance criteria

• From the frontend running locally, a call to GET /health succeeds against just dev.
• A request from an origin that isn't listed is blocked.
• The new settings are listed in .env.example.