feat: add CAMELEER_CORS_ALLOWED_ORIGINS for multi-origin CORS support

Behind a reverse proxy the browser sends Origin matching the proxy's
public URL, which the single-origin CAMELEER_UI_ORIGIN rejects.
New env var accepts comma-separated origins and takes priority over
UI_ORIGIN, which remains as a backwards-compatible fallback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

cameleer3-server-app/src/main/resources/application.yml

@@ -54,6 +54,7 @@ security:
   oidc-jwk-set-uri: ${CAMELEER_OIDC_JWK_SET_URI:}
   oidc-audience: ${CAMELEER_OIDC_AUDIENCE:}
   oidc-tls-skip-verify: ${CAMELEER_OIDC_TLS_SKIP_VERIFY:false}
+  cors-allowed-origins: ${CAMELEER_CORS_ALLOWED_ORIGINS:}
 
 
 springdoc: