feat: add CAMELEER_CORS_ALLOWED_ORIGINS for multi-origin CORS support

Behind a reverse proxy the browser sends Origin matching the proxy's
public URL, which the single-origin CAMELEER_UI_ORIGIN rejects.
New env var accepts comma-separated origins and takes priority over
UI_ORIGIN, which remains as a backwards-compatible fallback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/SERVER-CAPABILITIES.md

@@ -383,7 +383,8 @@ Registry: `gitea.siegeln.net/cameleer/cameleer3-server`
 | `CAMELEER_TENANT_ID` | No | `default` | Tenant identifier |
 | `CAMELEER_UI_USER` | No | `admin` | Default admin username |
 | `CAMELEER_UI_PASSWORD` | No | `admin` | Default admin password |
-| `CAMELEER_UI_ORIGIN` | No | `http://localhost:5173` | CORS allowed origin |
+| `CAMELEER_UI_ORIGIN` | No | `http://localhost:5173` | CORS allowed origin (single, legacy) |
+| `CAMELEER_CORS_ALLOWED_ORIGINS` | No | (empty) | Comma-separated CORS origins — overrides `UI_ORIGIN` when set |
 | `CLICKHOUSE_URL` | No | `jdbc:clickhouse://localhost:8123/cameleer` | ClickHouse JDBC URL |
 | `CLICKHOUSE_USERNAME` | No | `default` | ClickHouse user |
 | `CLICKHOUSE_PASSWORD` | No | (empty) | ClickHouse password |