Add Web App settings to the API Server panel

Mirror the PocketBase settings card with a superadmin-only Web App
section: it edits the Web App base URL (the address /api/status already
probed) and the CORS allowed origins, applying both at runtime and
persisting them to .env so they survive a restart.

The CORS middleware previously built its allow-list once, when Handler()
was constructed, so an edited origin list would not have taken effect
until a restart — which would have made the new field quietly lie. Move
the lookup into a per-request originAllowed helper reading under the
existing lock. Verified behaviour is unchanged: an allowed origin still
gets the headers plus Vary: Origin, an unknown origin gets none, and
preflight still returns 204.

PUT rejects an empty origin list rather than silently keeping the old
one, since an empty list would lock out every browser client.

The authenticated round trip (loading and saving real settings) is not
verified here — it needs a superadmin login.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

API Server/.env.example

@@ -19,10 +19,12 @@ POCKETBASE_ADMIN_EMAIL=
 POCKETBASE_ADMIN_PASSWORD=
 
 # CORS allowed origins for browser clients (comma separated, or * for any).
-# Native mobile apps are not subject to CORS.
+# Native mobile apps are not subject to CORS. Editable at runtime from the panel
+# (Web App section), which writes the change back into this file.
 CORS_ALLOW_ORIGINS=http://localhost:5173
 
-# Web App address, probed by GET /api/status and shown on the panel.
+# Web App address, probed by GET /api/status and shown on the panel. Editable at
+# runtime from the panel (Web App section).
 WEBAPP_URL=http://localhost:5173
 
 # PocketBase auth collection holding app users (default: users).