- Fix refresh token cookie Secure flag bug (was hardcoded to false)
- Wire up AllowedOrigins config in CORS middleware (router, handlers, chat, SSE)
- Add APP_ENV=production to Dockerfile and Dockerfile.cuda
- Update all docker-compose files with APP_ENV and ALLOWED_ORIGINS examples
- CORS now validates origins in production, allows all in development
- Increase gocyclo threshold from 20 to 25 for complex handlers