Add hostname configuration for production deployment

Add environment variable configuration to support deployment on custom
domains like https://awards.dj7nt.de

## Changes
- Add .env.example with configuration template
- Update API client to use VITE_API_BASE_URL with fallback to /api
- Update SvelteKit config to use VITE_APP_URL for CSRF trusted origins
- Update backend CORS to use configurable allowed origins
- Add ALLOWED_ORIGINS environment variable for production
- Add build and preview scripts to package.json
- Update README with production deployment guide and nginx example

## Environment Variables
- VITE_APP_URL: Application hostname (e.g., https://awards.dj7nt.de)
- VITE_API_BASE_URL: API base URL (empty = relative paths)
- ALLOWED_ORIGINS: Comma-separated CORS origins
- JWT_SECRET: Strong secret for production
- NODE_ENV: development/production

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

README.md

@@ -87,13 +87,28 @@ cd award
 bun install
 ```
 
-3. Set up environment variables (optional):
-Create a `.env` file in the project root:
-```env
-JWT_SECRET=your-secret-key-here
+3. Set up environment variables:
+Create a `.env` file in the project root (copy from `.env.example`):
+```bash
+cp .env.example .env
 ```
 
-If not provided, a default secret will be used.
+Edit `.env` with your configuration:
+```env
+# Application URL (for production deployment)
+VITE_APP_URL=https://awards.dj7nt.de
+
+# API Base URL (leave empty for same-domain deployment)
+VITE_API_BASE_URL=
+
+# JWT Secret (generate with: openssl rand -base64 32)
+JWT_SECRET=your-generated-secret-here
+
+# Environment
+NODE_ENV=production
+```
+
+**For development**: You can leave `.env` empty or use defaults.
 
 4. Initialize the database:
 ```bash
@@ -217,6 +232,74 @@ In production, you can either:
 2. **Keep the proxy setup** with a proper reverse proxy (nginx, caddy)
 3. **Use SvelteKit adapter** for Node/Bun to serve everything from one process
 
+## Production Deployment
+
+### Building for Production
+
+```bash
+# Build the frontend
+bun run build
+
+# Preview the production build locally
+bun run preview
+```
+
+### Deployment Options
+
+#### Option 1: Static Site + Backend Server
+
+1. Build the frontend: `bun run build`
+2. Serve `src/frontend/build/` with Elysia using `@elysiajs/static`
+3. Backend runs on one port serving both frontend and API
+
+#### Option 2: Reverse Proxy (Recommended)
+
+Use nginx or Caddy to proxy:
+- `/` → SvelteKit frontend (port 5173 or static files)
+- `/api` → Elysia backend (port 3001)
+
+**Example nginx configuration:**
+```nginx
+server {
+    server_name awards.dj7nt.de;
+
+    # Frontend
+    location / {
+        proxy_pass http://localhost:5173;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection 'upgrade';
+        proxy_set_header Host $host;
+        proxy_cache_bypass $http_upgrade;
+    }
+
+    # Backend API
+    location /api {
+        proxy_pass http://localhost:3001;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+    }
+}
+```
+
+#### Option 3: Single Process with SvelteKit Node Adapter
+
+Use `@sveltejs/adapter-node` to build for Node/Bun:
+- Everything runs in one process
+- API routes handled by SvelteKit (need to migrate from Elysia)
+
+### Environment Variables for Production
+
+Make sure to set these in your production environment:
+
+```bash
+VITE_APP_URL=https://awards.dj7nt.de
+VITE_API_BASE_URL=  # Leave empty for same-domain
+JWT_SECRET=<strong-random-string>
+NODE_ENV=production
+```
+
 ## Features in Detail
 
 ### Background Job Queue