Update CORS handling in Traefik and Caddy configurations

- Add origin-specific CORS settings to Traefik for `truckwash.io` with credentials support.
- Simplify and standardize CORS headers in Caddy, removing upstream duplication and adjusting preflight logic.

services/caddy/Caddyfile

@@ -7,11 +7,8 @@
     encode gzip
     root * /var/www/html
 
-    # CORS: allow all origins with literal '*' (no credentials)
-    @cors_origin header_regexp Origin .+
-    @options method OPTIONS
-
-    header @cors_origin {
+    # Global CORS headers: allow all origins and headers (no credentials)
+    header {
         # Ensure no duplicate CORS headers from upstream app
         -Access-Control-Allow-Origin
         -Access-Control-Allow-Credentials
@@ -25,9 +22,8 @@
     }
 
     # Preflight fast-path
-    respond @options 204 {
-        header @cors_origin
-    }
+    @options method OPTIONS
+    respond @options 204
 
     # PHP handling via FastCGI to php-fpm pool
     php_fastcgi php1:9000 php2:9000 php3:9000 php4:9000 php5:9000

services/traefik/dynamic.yml

@@ -45,6 +45,20 @@ http:
         customFrameOptionsValue: "SAMEORIGIN"
         permissionsPolicy: "geolocation=(), microphone=(), camera=(), payment=()"
         addVaryHeader: true
+        # CORS: allow all origins (with credentials). Attach this middleware where needed.
+        accessControlAllowOriginList:
+          - "https://truckwash.io"
+        accessControlAllowMethods:
+          - GET
+          - POST
+          - PUT
+          - PATCH
+          - DELETE
+          - OPTIONS
+        accessControlAllowHeaders:
+          - "*"
+        accessControlAllowCredentials: true
+        accessControlMaxAge: 86400
     api-ratelimit:
       rateLimit:
         average: 100