docs: use CORS_ORIGIN, the env var the server actually reads

The root .env.example, API.md, and README.md told users to set
ALLOWED_ORIGIN, but the server's entry point (index.js -> config/env.js)
reads only CORS_ORIGIN and throws "CORS_ORIGIN must be set in production"
on boot when it is unset. ALLOWED_ORIGIN is read only by the unreferenced
legacy app.js. So following the docs left CORS_ORIGIN unset and crashed
production on startup.

Align the root docs on CORS_ORIGIN (matching config/env.js and the
server's own server/.env.example and server/README.md), and fix the
API.md env table, which had the two names inverted.

Author: Anexus5919

.env.example

@@ -20,7 +20,7 @@ VITE_APPCHECK_RECAPTCHA_KEY=
 # Backend CORS Configuration
 # Set this to your deployed frontend URL in production (e.g. https://yourapp.com)
 # Defaults to http://localhost:5173 for local development if not set
-ALLOWED_ORIGIN=http://localhost:5173
+CORS_ORIGIN=http://localhost:5173
 
 # Backend URL (read by the client)
 # Base URL of the backend; the client derives the WebSocket URL by swapping

API.md

@@ -50,7 +50,7 @@ VITE_BACKEND_URL=http://localhost:3001
 
 ```
 PORT=3001
-ALLOWED_ORIGIN=http://localhost:5173
+CORS_ORIGIN=http://localhost:5173
 SOCKET_AUTH_TOKEN=your-secret-token
 HEALTH_SECRET_TOKEN=your-health-token
 MAX_FRAMES_PER_SEC=60
@@ -449,8 +449,7 @@ Full reference for all environment variables consumed by the backend.
 | Variable                 | Default | Required         | Description                                                     |
 | ------------------------ | ------- | ---------------- | --------------------------------------------------------------- |
 | `PORT`                   | `3001`  | No               | Port the HTTP server listens on                                 |
-| `ALLOWED_ORIGIN`         | —       | Yes (production) | CORS allowed origin — set to your frontend URL                  |
-| `CORS_ORIGIN`            | —       | No               | Alias for `ALLOWED_ORIGIN` (legacy)                             |
+| `CORS_ORIGIN`            | —       | Yes (production) | CORS allowed origin; set to your frontend URL (the server throws on boot if unset in production) |
 | `SOCKET_AUTH_TOKEN`      | `null`  | Server-only      | Shared secret for machine-to-machine/proxy auth via `socket.handshake.auth.token`. **Do not** expose in client bundles — use Firebase Auth tokens for browser clients instead |
 | `HEALTH_SECRET_TOKEN`    | —       | No               | Bearer token that grants full metrics on `GET /health`          |
 | `MAX_FRAMES_PER_SEC`     | `60`    | No               | Per-socket frame rate ceiling                                   |

README.md

@@ -417,7 +417,7 @@ VITE_BACKEND_URL=http://localhost:3001
 
 ```env
 PORT=3001
-ALLOWED_ORIGIN=http://localhost:5173
+CORS_ORIGIN=http://localhost:5173
 ```
 
 > ⚠️ **Never commit `.env` files to version control.** The `.env.example` file is provided as a template.
@@ -543,7 +543,7 @@ npx vercel
 
 ### Backend
 
-The backend is a standalone Express + Socket.io server. Deploy to any Node.js-compatible platform (Railway, Render, Fly.io, etc.) and set the `ALLOWED_ORIGIN` env var to your frontend URL.
+The backend is a standalone Express + Socket.io server. Deploy to any Node.js-compatible platform (Railway, Render, Fly.io, etc.) and set the `CORS_ORIGIN` env var to your frontend URL.
 
 ---