add CSRF_TRUSTED_ORIGINS setting for reverse-proxied domains

Admin login (and any POST form) fails with "Origin checking failed"
behind a proxy that terminates TLS, since Django had no trusted-origins
list configured at all.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.env.example

@@ -10,6 +10,7 @@
 DJANGO_DEBUG=1
 DJANGO_SECRET_KEY=
 DJANGO_ALLOWED_HOSTS=localhost,127.0.0.1
+CSRF_TRUSTED_ORIGINS=
 CACHE_URL=
 
 # اختیاری — بدونش OTP واقعی ارسال نمی‌شه (فقط خطای صریح ۵۰۳ برمی‌گرده،

config/settings.py

@@ -51,6 +51,8 @@ if not SECRET_KEY:
 
 ALLOWED_HOSTS = [h for h in os.environ.get('DJANGO_ALLOWED_HOSTS', '').split(',') if h]
 
+CSRF_TRUSTED_ORIGINS = [o for o in os.environ.get('CSRF_TRUSTED_ORIGINS', '').split(',') if o]
+
 
 # Application definition