feat: allow wildcard web origins for local tunnel testing

apps/api/.env.example

@@ -1,4 +1,5 @@
-DATABASE_URL="mysql://USER:PASSWORD@HOST:3306/worthpath"
-PORT=3100
-WEB_ORIGIN=http://localhost:5173
-COOKIE_SECURE=false
+DATABASE_URL="mysql://USER:PASSWORD@HOST:3306/worthpath"
+PORT=3100
+# Local tunnel testing may use WEB_ORIGIN=*. Production requires an exact origin.
+WEB_ORIGIN=http://localhost:5173
+COOKIE_SECURE=false