feat(api): configure CORS origins from environment variable (FRO-61)

.gitignore

@@ -113,6 +113,8 @@ pids/
 .env
 .env.*
 !.env.example
+!.env.staging
+!.env.production
 
 # =====================================================
 # IDEs and Editors
@@ -185,3 +187,4 @@ docker-compose.override.yml
 
 ## Diagnostic reports
 report.[0-9]*.[0-9]*.[0-9]*.[0-9]*.json
+.vercel

src/backend/src/FantasyRealm.Api/Program.cs

@@ -21,11 +21,14 @@ private static void Main(string[] args)
             builder.Services.AddSwaggerGen();
 
             // CORS configuration
+            var corsOrigins = builder.Configuration["CorsOrigins"]?.Split(',')
+                ?? new[] { "http://localhost:5173" };
+
             builder.Services.AddCors(options =>
             {
                 options.AddPolicy("AllowFrontend", policy =>
                 {
-                    policy.WithOrigins("http://localhost:5173")
+                    policy.WithOrigins(corsOrigins)
                           .AllowAnyMethod()
                           .AllowAnyHeader()
                           .AllowCredentials();

src/frontend/.env.production

@@ -0,0 +1,2 @@
+# Production environment - Railway backend (à configurer quand l'environnement de production sera créé)
+# VITE_API_URL=https://fantasyrealm-api-production.up.railway.app/api

src/frontend/.env.staging

@@ -0,0 +1,2 @@
+# Staging environment - Railway backend
+VITE_API_URL=https://fantasyrealm-api-staging.up.railway.app/api

src/frontend/package.json

@@ -6,6 +6,7 @@
   "scripts": {
     "dev": "vite",
     "build": "tsc -b && vite build",
+    "build:staging": "tsc -b && vite build --mode staging",
     "lint": "eslint .",
     "lint:fix": "eslint . --fix",
     "format": "prettier --write \"src/**/*.{ts,tsx,css}\"",