Add configurable CORS origin, challenge difficulty, and demo proxy support

[rayshoo]

Summary

• Add CORS_ORIGIN env var to restrict allowed origins (defaults to *)
• Add MAXNUMBER env var to control challenge difficulty (Proof-of-Work cost)
• Proxy /challenge requests through demo server instead of hardcoding http://localhost:3000, fixing connectivity issues when the server runs on a remote host (e.g., Docker on a remote VM)
• Simplify CSP headers by removing unnecessary localhost references

Motivation

When running the server inside Docker on a remote host, the demo page fails because the ALTCHA widget tries to reach http://localhost:3000/challenge from the browser, which points to the user's local machine instead of
the Docker host.

Additionally, there was no way to configure CORS origins or challenge difficulty without modifying the source code.

Changes

• src/index.ts: Configurable CORS via CORS_ORIGIN, configurable difficulty via MAXNUMBER, /challenge proxy route on demo server
• src/demo/index.html: Use relative challengeurl="/challenge" instead of absolute URL
• .env.example: Document new environment variables