Changeset 0.28.8 (#194)

docs/ARCHITECTURE.md

@@ -543,7 +543,18 @@ The appearance settings offer three modes: Light, Dark, System. System mode list
 - **Policies**: Boolean flags in `global_settings` table control registration, BYOK, team providers, etc.
 - **Audit**: All admin operations logged to `audit_log` with actor, action, resource type/ID, and diff
 - **Banner**: Environment classification banner configurable via admin settings (text, color, position)
-- **CORS**: Configurable allowed origins via env var
+- **CORS**: `CORS_ALLOWED_ORIGINS` env var controls which origins can make
+  cross-origin requests (HTTP and WebSocket). Comma-separated list of
+  allowed origins, e.g. `https://switchboard.corp,https://admin.corp`.
+  Behavior by environment:
+  - **Production** (`ENVIRONMENT=production`): if unset, defaults to
+    same-origin only (no `Access-Control-Allow-Origin` header). Set
+    explicitly to the domain(s) serving the frontend.
+  - **Development/test**: if unset, defaults to `*` (all origins).
+  - **Explicit `*`**: allowed but logs a startup warning. Not recommended
+    for production — restricts nothing and exposes the API to any origin.
+  The WebSocket upgrader's `CheckOrigin` respects the same setting.
+  Connections from origins not in the list are rejected at upgrade time.
 - **No sensitive terminology**: Banner system avoids classification-related terms for security compliance
 
 ## File Storage