Add CorsRegexEnvProcessor and corresponding tests

- Implemented CorsRegexEnvProcessor to build CORS origin regex from a comma-separated host list (ALLOWED_FRONTEND_HOSTS).
- Added tests for CorsRegexEnvProcessor to validate regex generation and matching behavior.
- Created JSON files for AST representation of the new classes and tests.

docker-compose.yml

@@ -25,7 +25,6 @@ x-app-env: &app-env
   JWT_SECRET_KEY: "%kernel.project_dir%/config/jwt/private.pem"
   JWT_PUBLIC_KEY: "%kernel.project_dir%/config/jwt/public.pem"
   JWT_PASSPHRASE: ${JWT_PASSPHRASE}
-  CORS_ALLOW_ORIGIN: ${CORS_ALLOW_ORIGIN}
   DEFAULT_URI: ${APP_BASE_URL}
   APP_BASE_URL: ${APP_BASE_URL}
   ALLOWED_FRONTEND_HOSTS: ${ALLOWED_FRONTEND_HOSTS}
@@ -48,8 +47,9 @@ services:
   # In Coolify, assign ALL serving domains to THIS service (port 80) — the backend
   # API host plus every frontend domain you want Traefik to route + issue TLS for.
   # Coolify supports a comma-separated domain list on the service.
-  # CORS/payload allow-listing for those frontends is handled separately via
-  # CORS_ALLOW_ORIGIN / ALLOWED_FRONTEND_HOSTS (see docker/frontend-domains.json).
+  # CORS/payload allow-listing for those frontends is driven by ALLOWED_FRONTEND_HOSTS
+  # (the CORS regex is built from it in PHP via CorsRegexEnvProcessor; see
+  # docker/frontend-domains.json). CORS_ALLOW_ORIGIN is no longer used.
   app:
     # Shared image tag — app builds it once; the two workers reuse the SAME image
     # (image: below, no build:). Without this Coolify builds the Dockerfile 3×,