feat(api): implement CORS support with environment-based configuration

- Add CORS headers to all API responses in main.lua
- Implement OPTIONS preflight request handling
- Add environment-variable based CORS origin configuration
- Create production.env.example for deployment documentation
- Update .env.example with CORS_ALLOWED_ORIGINS setting

Resolves cross-origin request blocking for Hugo dev server integration.
CORS origins now configurable via CORS_ALLOWED_ORIGINS environment variable
for production deployments while maintaining dev-friendly defaults.

Related to #49

.env.example

@@ -15,6 +15,14 @@ LUA_VERSION=5.1
 GATEWAY_PORT=8080
 GATEWAY_LOG_LEVEL=info
 
+# CORS-Konfiguration (comma-separated list)
+# Development (default if not set):
+# CORS_ALLOWED_ORIGINS=http://localhost:1313,http://127.0.0.1:1313
+#
+# Production example:
+# CORS_ALLOWED_ORIGINS=https://yourdomain.com,https://www.yourdomain.com
+CORS_ALLOWED_ORIGINS=http://localhost:1313,http://127.0.0.1:1313
+
 # Service-Ports (für lokale Entwicklung)
 FORMULAR2MAIL_PORT=8081
 SAGJAN_PORT=8082