fix: use $env/dynamic/private in hooks.server.ts for CSRF allowlist

- ALLOWED_ORIGINS and NODE_ENV now read via $env/dynamic/private so Vite dev
  server picks them up correctly from .env
- .env.example: document ALLOWED_ORIGINS with dev IP example
- .env: add http://192.168.0.94:5173 to ALLOWED_ORIGINS for local dev

.env.example

@@ -1,7 +1,10 @@
 # Copy this to .env and fill in values for local development.
 # In production, set these as environment variables / Kubernetes secrets.
 
-# bcrypt hash of the admin password. Generate with:
+# Comma-separated list of additional allowed CORS origins.
+# Add your dev machine's IP here if accessing via IP address.
+# e.g. ALLOWED_ORIGINS=http://192.168.0.94:5173
+ALLOWED_ORIGINS=
 #   python3 -c "import bcrypt; print(bcrypt.hashpw(b'yourpassword', bcrypt.gensalt(rounds=12)).decode())"
 PASSWORD_HASH=