Konfigurierbares CORS per ZMB_CORS_ORIGINS + dynamische Frontend-URL

- main.py: CORS-Origins aus ZMB_CORS_ORIGINS (kommagetrennt), Default "*"
- allow_credentials automatisch aktiv bei konkreten Origins, aus bei "*"
- Root-Endpoint liefert Frontend-URL dynamisch via request.base_url
- keine hartkodierten IPs mehr im Anwendungscode
- Doku in CLAUDE.md und systemd-Unit ergaenzt

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

deploy/zfs-manager-backend.service

@@ -9,6 +9,10 @@ WorkingDirectory=/opt/zmb-webui/backend
 Environment="PATH=/opt/zmb-webui/venv/bin"
 Environment="PYTHONUNBUFFERED=1"
 Environment="PYTHONDONTWRITEBYTECODE=1"
+# CORS: comma-separated list of allowed frontend origins.
+# Leave unset (or "*") for development. Set to specific origins in production,
+# e.g. Environment="ZMB_CORS_ORIGINS=https://<host>:8090"
+#Environment="ZMB_CORS_ORIGINS=*"
 
 ExecStart=/opt/zmb-webui/venv/bin/python -m uvicorn main:app \
     --host 0.0.0.0 \