fix(security): no dev key, demo seed or open CORS in production (SEC-04, SEC-05)

- production refuses to boot without JWT_SECRET instead of signing
  admin tokens with the published development key
- CORS_ORIGINS restricts browser callers; blank keeps allow-all with a
  production warning so a running deployment is not cut off
- the boot-time seed creates only roles and permissions in production;
  the demo customers, orders, debt and known-password accounts need
  SEED_DEMO_DATA=true

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/.env.example

@@ -51,3 +51,16 @@ SMS_ADMIN_RECIPIENTS=
 ACCOUNTING_SECRET_KEY=
 # "off" keeps this instance out of the background sync.
 ACCOUNTING_WORKER=
+
+# SEC-04 — browser origins allowed to call the API, comma-separated, exact
+# (e.g. https://adm.example.ir,https://app.example.ir). Blank = any origin
+# (development); in production a blank list prints a warning at boot.
+# In production (NODE_ENV=production) JWT_SECRET is REQUIRED: the API refuses
+# to start on the built-in development key.
+CORS_ORIGINS=
+
+# SEC-05 — the seed runs once on a fresh database at boot. In production it
+# creates roles and permissions only; set "true" to force the demo data
+# (sample customers, orders, debt and known-password accounts). Never in a
+# real deployment.
+SEED_DEMO_DATA=