Add CORS support for production domain

- Add STORYCOVE_CORS_ALLOWED_ORIGINS environment variable to docker-compose.yml
- Include production domain https://storycove.sharyavin.synology.me in allowed origins
- Update SecurityConfig to read from environment variable with fallback
- Maintains localhost support for development while enabling production access
- Fixes "Invalid CORS request" error on deployed application

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <noreply@anthropic.com>

docker-compose.yml

@@ -39,6 +39,7 @@ services:
       - TYPESENSE_PORT=8108
       - IMAGE_STORAGE_PATH=/app/images
       - APP_PASSWORD=${APP_PASSWORD}
+      - STORYCOVE_CORS_ALLOWED_ORIGINS=https://storycove.sharyavin.synology.me,http://localhost:3000
     volumes:
       - images_data:/app/images
     depends_on: