4aca82fb1a
CORS_ORIGINS was hardcoded in docker-compose.yml, silently overriding .env and breaking login for users who change the frontend port. It now comes from .env exclusively, with a clear comment in .env.example. Login page now distinguishes network errors (CORS/offline) from wrong credentials, and footer correctly references .env instead of config.yml.