Add CorsRegexEnvProcessor and corresponding tests

- Implemented CorsRegexEnvProcessor to build CORS origin regex from a comma-separated host list (ALLOWED_FRONTEND_HOSTS).
- Added tests for CorsRegexEnvProcessor to validate regex generation and matching behavior.
- Created JSON files for AST representation of the new classes and tests.

docker/gen-cors-env.php

@@ -6,9 +6,11 @@
  * Usage:
  *   php docker/gen-cors-env.php
  *
- * Output: CORS_ALLOW_ORIGIN (single regex, explicit alternation) and
- *         ALLOWED_FRONTEND_HOSTS (comma-separated host list).
- * Paste both into the Coolify Environment Variables tab.
+ * Output: ALLOWED_FRONTEND_HOSTS (comma-separated host list).
+ * Paste it into the Coolify Environment Variables tab. The CORS origin regex is
+ * built in PHP from this list (App\Shared\DependencyInjection\CorsRegexEnvProcessor),
+ * so CORS_ALLOW_ORIGIN is no longer needed — a `$`-containing regex env gets mangled
+ * by Coolify's interpolation, which is exactly the bug this avoids.
  */
 
 $jsonFile = __DIR__ . '/frontend-domains.json';
@@ -50,13 +52,9 @@ if (empty($domains)) {
     exit(1);
 }
 
-// CORS: explicit alternation, anchored, dots escaped. https only.
-$alternation = implode('|', array_map(static fn (string $d): string => preg_quote($d, '/'), $domains));
-$cors = "^https://($alternation)$";
-
-// Frontend hosts: bare hostnames, comma-separated (matched via in_array in PaymentController).
+// Frontend hosts: bare hostnames, comma-separated. Drives both the CORS regex
+// (CorsRegexEnvProcessor) and PaymentController host validation.
 $hosts = implode(',', $domains);
 
 echo "# ---- paste into Coolify env (" . count($domains) . " domains) ----\n\n";
-echo "CORS_ALLOW_ORIGIN='" . $cors . "'\n\n";
 echo "ALLOWED_FRONTEND_HOSTS=" . $hosts . "\n";