docs: update .env.example to include CORS/CSRF origins configuration

Author: kriss145

.env.example

@@ -1,3 +1,5 @@
 DATABASE_URL=postgresql://user:password@localhost:5432/training_app
 PAYLOAD_SECRET=your-long-random-secret-here
 NEXT_PUBLIC_BASE_URL=http://localhost:3000
+# Optional: extra allowed CORS/CSRF origins, comma-separated (defaults to NEXT_PUBLIC_BASE_URL)
+# PAYLOAD_CORS=https://example.com,https://www.example.com