Fix hardcoded ORIGIN in docker-compose.yml

- Change ORIGIN from hardcoded localhost to use environment variable
- Allows production deployment with correct domain for CSRF protection
- Maintains localhost default for local development

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

docker-compose.yml

@@ -291,7 +291,7 @@ services:
       SUPABASE_SERVICE_ROLE_KEY: ${SERVICE_ROLE_KEY}
       SUPABASE_INTERNAL_URL: http://kong:8000
       NODE_ENV: production
-      ORIGIN: http://localhost:7453
+      ORIGIN: ${ORIGIN:-http://localhost:7453}
       # Body size limit for file uploads (50MB)
       BODY_SIZE_LIMIT: ${BODY_SIZE_LIMIT:-52428800}
     depends_on: