Fix #20: DDL removal from register.php, CORS policy, secret leak

- Removed ALTER TABLE DDL statements from Admin/auth/register.php (belongs in migration scripts)
- Added validated CORS with configurable allowed origins via CORS_ALLOWED_ORIGINS env var
- Removed  assignment in load_env.php (secrets no longer exposed in superglobal)

backend/load_env.php

@@ -15,7 +15,6 @@ function loadEnvironment($env_file) {
             $value = trim($value, "\"'");
             putenv("$keyName=$value");
             $_ENV[$keyName] = $value;
-            $_SERVER[$keyName] = $value;
         }
     }