Disable auto HTTPS and improve CORS handling in Caddyfile for internal HTTP and simplified preflight responses.

services/caddy/Caddyfile

@@ -1,3 +1,15 @@
+{
+    # Traefik terminates TLS; Caddy should serve plain HTTP internally
+    auto_https off
+}
+
+:80 {
+    encode gzip
+    root * /var/www/html
+
+    # CORS: allow all origins with literal '*' (no credentials)
+    @cors_origin header_regexp Origin .+
+    @options method OPTIONS
 
     header @cors_origin {
         # Ensure no duplicate CORS headers from upstream app
@@ -7,7 +19,6 @@
         -Access-Control-Allow-Headers
         -Access-Control-Max-Age
         Access-Control-Allow-Origin "*"
-        Access-Control-Allow-Credentials "true"
         Access-Control-Allow-Methods "GET, POST, OPTIONS, PUT, DELETE"
         Access-Control-Allow-Headers "Authorization, Content-Type, X-Requested-With, X-Customer-Number"
         Access-Control-Max-Age 86400