fix: enable CORS credentials and externalize frontend origin for Sanctum SPA auth

[zigzagdev]

Motivation

Investigating the reported bug "user mypage does not display after login" found two issues in the CORS/Sanctum configuration:

1. config/cors.php had supports_credentials set to false. Sanctum's cookie-based SPA auth requires the frontend to send requests with credentials: 'include', and the browser only forwards/accepts the session cookie cross-origin if the server responds with Access-Control-Allow-Credentials: true. With it false, login appeared to succeed (the cookie was issued) but subsequent authenticated requests (e.g. fetching the current user for mypage) were silently blocked by the browser.
2. The frontend origin was hardcoded in allowed_origins (http://localhost:3876, plus a stale http://127.0.0.1:5173 entry left over from Vite's default port), which drifted from the actual frontend dev port and from the frontend's own VITE_API_BASE_URL env-based configuration.

Closes #540

What I have done

• Set supports_credentials to true in config/cors.php and added a comment explaining why it's required for Sanctum cookie auth
• Replaced the hardcoded frontend origins in allowed_origins with env('FRONTEND_URL', 'http://localhost:3876')
• Added FRONTEND_URL to .env.example (and local .env, not committed) so both frontend and backend reference the same configurable origin

Test Results

• Verified via docker exec heritage-app php artisan tinker --execute="print_r(config('cors'));" that allowed_origins resolves to ['http://localhost:3876', 'https://zigzagdev.github.io'] and supports_credentials is true (1)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.21%. Comparing base (0ea56e1) to head (cc7f52f).

Additional details and impacted files

@@                   Coverage Diff                   @@
##             fix/cors-credentials     #541   +/-   ##
=======================================================
  Coverage                   62.21%   62.21%           
  Complexity                   1604     1604           
=======================================================
  Files                         135      135           
  Lines                        8252     8252           
=======================================================
  Hits                         5134     5134           
  Misses                       3118     3118           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[zigzagdev]

Ok