docs(#414): add TRUSTED_ORIGINS and COOKIE_DOMAIN to .env.example

Refs #414

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

.env.example

@@ -117,6 +117,14 @@ JWT_EXPIRATION=24h
 # Example: openssl rand -base64 32
 BETTER_AUTH_SECRET=REPLACE_WITH_RANDOM_SECRET_MINIMUM_32_CHARS
 
+# Trusted Origins (comma-separated list of additional trusted origins for CORS and auth)
+# These are added to NEXT_PUBLIC_APP_URL and NEXT_PUBLIC_API_URL automatically
+TRUSTED_ORIGINS=
+
+# Cookie Domain (for cross-subdomain session sharing)
+# Leave empty for single-domain setups. Set to ".example.com" for cross-subdomain.
+COOKIE_DOMAIN=
+
 # ======================
 # Encryption (Credential Security)
 # ======================